Description
Stack-based buffer overflow in the Plug and Play (PnP) service (UMPNPMGR.DLL) in Microsoft Windows 2000 SP4, and XP SP1 and SP2, allows remote or local authenticated attackers to execute arbitrary code via a large number of "\" (backslash) characters in a registry key name, which triggers the overflow in a wsprintfW function call.
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Metasploit 1 module
-
Microsoft Plug and Play Service Registry Overflow
auxiliary/dos/windows/smb/ms05_047_pnp
Exploit-DB 2
- Microsoft Windows Plug-and-Play - 'Umpnpmgr.dll' Denial of Service (MS05-047) (2) EDB-1271 · dos · Oct 24, 2005 · verified
- Microsoft Windows Plug-and-Play - 'Umpnpmgr.dll' Denial of Service (MS05-047) (1) EDB-1269 · dos · Oct 21, 2005 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- 15065 vdb-entry
- 17166 third-party-advisory
- MS05-047 vendor-advisory
- http://support.avaya.com/elmodocs2/security/ASA-2005-214.pdf
- 17223 third-party-advisory
- oval:org.mitre.oval:def:1244 vdb-entry signature
- 1015042 vdb-entry
- AD20051011c third-party-advisory
- 71 third-party-advisory
- 18830 vdb-entry
- 17172 third-party-advisory
- VU#214572 third-party-advisory
- oval:org.mitre.oval:def:1328 vdb-entry signature
- oval:org.mitre.oval:def:1519 vdb-entry signature
- TA05-284A third-party-advisory