CVE-2005-4560
EXPLOITED IN THE WILDWindows 2003 Server and XP - Remote Code Execution via Crafted WMF SETABORTPROC GDI Escape
Title source: llmExploitation Summary
CVE-2005-4560 has been observed exploited in the wild (reported by VulnCheck KEV, InTheWild.io).
EIP tracks 2 public exploits from researchers including Metasploit, hdm, including a Metasploit module exploits/windows/browser/ms06_001_wmf_setabortproc.
AI-analyzed exploit summary This Metasploit module exploits CVE-2005-4560 by crafting a malicious WMF file that leverages the 'Escape' metafile function to execute arbitrary code via the SetAbortProc procedure. It generates a random WMF record stream for each request to bypass simple signature detection.
Description
The Windows Graphical Device Interface library (GDI32.DLL) in Microsoft Windows allows remote attackers to execute arbitrary code via a Windows Metafile (WMF) format image with a crafted SETABORTPROC GDI Escape function call, related to the Windows Picture and Fax Viewer (SHIMGVW.DLL), a different vulnerability than CVE-2005-2123 and CVE-2005-2124, and as originally discovered in the wild on unionseek.com.
Exploits (2)
This Metasploit module exploits CVE-2005-4560 by crafting a malicious WMF file that leverages the 'Escape' metafile function to execute arbitrary code via the SetAbortProc procedure. It generates a random WMF record stream for each request to bypass simple signature detection.
This Metasploit module exploits CVE-2005-4560 by crafting a malicious WMF file that leverages the 'Escape' metafile function to execute arbitrary code via the SetAbortProc procedure. It generates a random WMF record stream for each request to bypass detection.