Description
The GetEnhMetaFilePaletteEntries API in GDI32.DLL in Windows 2000 allows remote attackers to cause a denial of service (application crash) via a crafted Enhanced Metafile (EMF) file that causes invalid (1) end, (2) emreof, or (3) palent offsets to be used, aka "Enhanced Metafile Vulnerability."
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 2
- Microsoft Windows Metafile - 'mtNoObjects' Denial of Service (MS05-053) EDB-1346 · dos · Nov 30, 2005 · verified
- Microsoft Windows XP/2000/2003 - Graphical Device Interface Library Denial of Service EDB-25231 · dos · Mar 17, 2005 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- oval:org.mitre.oval:def:1152 vdb-entry signature
- http://support.avaya.com/elmodocs2/security/ASA-2005-228.pdf
- 20580 vdb-entry
- win-2000-gdi32dll-dos(19727) vdb-entry
- 17461 third-party-advisory
- ADV-2005-2348 vdb-entry
- VU#134756 third-party-advisory
- 14631 third-party-advisory
- 12834 vdb-entry
- 1015168 vdb-entry
- TA05-312A third-party-advisory
- 17223 third-party-advisory
- oval:org.mitre.oval:def:1240 vdb-entry signature
- 20050317 Windows 2000 GDI32.DLL GetEnhMetaFilePaletteEntries() API specially crafted EMF file DOS vulnerability mailing-list
- MS05-053 vendor-advisory
- oval:org.mitre.oval:def:1121 vdb-entry signature
- oval:org.mitre.oval:def:1215 vdb-entry signature
- oval:org.mitre.oval:def:671 vdb-entry signature