9.3
CVSSv2

CVE-2007-0038

Published: 30/03/2007 Updated: 16/10/2018
CVSS v2 Base Score: 9.3 | Impact Score: 10 | Exploitability Score: 8.6
VMScore: 1000
Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C

Vulnerability Summary

Stack-based buffer overflow in the animated cursor code in Microsoft Windows 2000 SP4 through Vista allows remote malicious users to execute arbitrary code or cause a denial of service (persistent reboot) via a large length value in the second (or later) anih block of a RIFF .ANI, cur, or .ico file, which results in memory corruption when processing cursors, animated cursors, and icons, a variant of CVE-2005-0416, as originally demonstrated using Internet Explorer 6 and 7. NOTE: this might be a duplicate of CVE-2007-1765; if so, then CVE-2007-0038 should be preferred.

Vulnerability Trend

Vulnerable Product Search on Vulmon Subscribe to Product

microsoft windows 2003 server sp1

microsoft windows 2003 server sp2

microsoft windows xp

microsoft windows 2000

microsoft windows 2003 server gold

microsoft windows vista

Exploits

/* GDI Local Elevation of Privilege Vulnerability Exploit (MS07-017) Coded by Lionel d'Hauenens wwwlabo-assocom Development: ------------ Dev-C++ 4992 Linked with /lib/libgdi32a References: ----------- wwwmicrosoftcom/technet/security/bulletin/MS07-017mspx researcheeyecom/html/alerts/zeroday/20061106html http:/ ...
#define _WIN32_WINNT 0x0500 #include <windowsh> #include <shlwapih> #include <stdioh> #pragma comment (lib, "user32lib") #pragma comment (lib, "gdi32lib") #pragma comment (lib, "shlwapilib") #pragma comment (lib, "ntdlllib") /* Here is a sploit for the GDI MS07-017 Local Privilege Escalation, presented during the last b ...
MS Windows (ANI) GDI Remote Elevation of Privilege Exploit (MS07-017) githubcom/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/3804zip (04262007-gdi_remote_elevation_privilege_exploit_ms07_017_principalzip) # milw0rmcom [2007-04-26] ...
## # $Id: ms07_017_ani_loadimage_chunksizerb 9984 2010-08-12 16:56:41Z jduck $ ## ## # This file is part of the Metasploit Framework and may be subject to # redistribution and commercial restrictions Please see the Metasploit # Framework web site for more information on licensing and terms of use # metasploitcom/framework/ ## require ' ...
::[ jamikazu presents ]:: Windows Animated Cursor Handling Exploit (0day) (Version3) Works on fully patched Windows Vista I think it is first real remote code execution exploit on vista =) Tested on: Windows Vista Enterprise Version 60 (Build 6000) (default installation and UAC enabled) Windows Vista Ultimate Version 60 (Build 6000) (defau ...
Microsoft ANI Buffer Overflow Exploit Author: Trirat Puttaraksa sf-freedomblogspotcom Tested on: Windows XP SP2 fully patched + IE 6 SP2 For educational purpose only There are many confuses about this vulnerability Someone said that this could not be exploited in XP SP2 - that's wrong I provide this exploit because I wanna to tell t ...
/* * version 05 * Copyright (c) 2007 devcode * * * ^^ D E V C O D E ^^ * * Windows ANI LoadAniIcon Stack Overflow For Hardware DEP XP SP2 * [CVE-2007-1765] * * * Description: * A vulnerability has been identified in Microsoft Windows, * which could be exploited by remote attackers to take complete * control of an affected system This ...
/**************************************************************************** * MS Windows Explorer Unspecified ANI File DoS * * * * * * Another Ani bug that freezes Explor ...
/*************************************************************************** * MS Windows ANI File Local Buffer Overflow * * * * * * Credits go to Trirat Puttaraksa cause hi ...
/* ANI exploit tested on Windows XP SP2 - Portuguese Shellcode port bind 13579 JMP ESP Addr - ntdlldll Greetz: Marsu, Devcode, Str0ke, Dave, Sekureorg guys, Sauna Exploit coded listen sauna hits Featuring Luiz Zanardo's gigs "Minoide - \x52\x49\x46\x ...
::[ jamikazu presents ]:: Windows Animated Cursor Handling Exploit (0day) Works on fully patched Windows Vista I think it is first real remote code execution exploit on vista =) Tested on: Windows Vista Enterprise Version 60 (Build 6000) (default installation and UAC enabled) Windows Vista Ultimate Version 60 (Build 6000) (default installa ...
#!/usr/bin/env python # # $Id: win32-loadaniiconpy 4 2007-06-02 00:47:59Z ramon $ # # Windows Animated Cursor Stack Overflow Exploit # Copyright 2007 Ramon de Carvalho Valle <ramon@risesecurityorg>, # RISE Security <contact@risesecurityorg> # # This program is free software; you can redistribute it and/or modify # it und ...
## # $Id: ms07_017_ani_loadimage_chunksizerb 10394 2010-09-20 08:06:27Z jduck $ ## ## # This file is part of the Metasploit Framework and may be subject to # redistribution and commercial restrictions Please see the Metasploit # Framework web site for more information on licensing and terms of use # metasploitcom/framework/ ## require ...
#-------------------------------------------------------------------------------- # Info: ANI (RIFF Cursors) 2007 universal exploit generator # Tested on MS Internet Explorer 6x-7x, Windows XP SP2, Windows Vista # Author: Yag Kohha <skyhole [at] gmailcom> # 10x`n`Gr33tz 2: # Jamikazu, Skylined (pretty good t-short on BH07 Europe - L00k li ...
/* * Copyright (c) 2007 devcode * * * ^^ D E V C O D E ^^ * * Windows ANI LoadAniIcon Stack Overflow * [CVE-2007-1765] * * * Description: * A vulnerability has been identified in Microsoft Windows, * which could be exploited by remote attackers to take complete * control of an affected system This issue is due to a stack overflow * er ...