CVE-2004-0200
Microsoft .NET Framework - Remote Code Execution via JPEG COM Field Length Overflow
Title source: llmExploitation Summary
EIP tracks 6 public exploits for CVE-2004-0200. PoCs published by M4Z3R, John Bissell, ATmaCA.
AI-analyzed exploit summary This exploit targets CVE-2004-0200, a buffer overflow vulnerability in the GDI+ library used by Microsoft Windows to process JPEG images. The exploit includes multiple payloads (reverse shell, bind shell, HTTP download, and admin addition) embedded in a malformed JPEG file to achieve remote code execution.
Description
Buffer overflow in the JPEG (JPG) parsing engine in the Microsoft Graphic Device Interface Plus (GDI+) component, GDIPlus.dll, allows remote attackers to execute arbitrary code via a JPEG image with a small JPEG COM field length that is normalized to a large integer length before a memory copy operation.
Exploits (6)
This exploit targets CVE-2004-0200, a buffer overflow vulnerability in the GDI+ library used by Microsoft Windows to process JPEG images. The exploit includes multiple payloads (reverse shell, bind shell, HTTP download, and admin addition) embedded in a malformed JPEG file to achieve remote code execution.
This exploit targets CVE-2004-0200, a buffer overflow vulnerability in GDI+ JPEG processing. It includes shellcode for both reverse and bind shell attacks, designed to work on NT-based Windows systems.
This exploit targets CVE-2004-0200, a buffer overflow vulnerability in Windows GDI+ JPEG processing. It uses a crafted JPEG file with embedded shellcode to achieve remote code execution.
This exploit targets CVE-2004-0200, a heap overflow vulnerability in GDI+ (GDIPLUS.DLL) on Windows XP SP1. It crafts a malicious JPEG file that, when processed, executes shellcode to create a user in the Administrators group.
This exploit targets a buffer overflow vulnerability in GDI+ (CVE-2004-0200) by crafting a malicious JPEG file. The shellcode executes cmd.exe on Windows XP SP1 by leveraging a hardcoded address for system().
This exploit targets a JPEG parsing vulnerability in Microsoft Windows (CVE-2004-0200) by crafting a malicious JPEG file. It triggers a crash via a 0 or 1 length field in the JPEG header, with placeholder addresses for potential shellcode execution.