Description
The Windows Graphical Device Interface library (GDI32.DLL) in Microsoft Windows allows remote attackers to execute arbitrary code via a Windows Metafile (WMF) format image with a crafted SETABORTPROC GDI Escape function call, related to the Windows Picture and Fax Viewer (SHIMGVW.DLL), a different vulnerability than CVE-2005-2123 and CVE-2005-2124, and as originally discovered in the wild on unionseek.com.
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Metasploit 1 module
-
Windows XP/2003/Vista Metafile Escape() SetAbortProc Code Execution
exploit/windows/browser/ms06_001_wmf_setabortproc
Exploit-DB 1
- Microsoft Windows XP/Vista/2003 - Metafile Escape() SetAbortProc Code Execution (MS06-001) (Metasploit) EDB-16612 · remote · Sep 20, 2010 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- http://vil.mcafeesecurity.com/vil/content/v_137760.htm
- 20051228 Re: Is this a new exploit? mailing-list
- http://www.f-secure.com/weblog/archives/archive-122005.html#00000753
- 20051228 WMF Exploit mailing-list
- oval:org.mitre.oval:def:1492 vdb-entry signature
- 20051228 RE: [Full-disclosure] Someone wasted a nice bug on spyware... mailing-list
- oval:org.mitre.oval:def:1564 vdb-entry signature
- 18255 third-party-advisory
- oval:org.mitre.oval:def:1612 vdb-entry signature
- ADV-2005-3086 vdb-entry
- 1015416 vdb-entry
- 20051227 Exploitation of Windows WMF on the web mailing-list
- 20051229 WMF exploit mailing-list
- win-wmf-execute-code(23846) vdb-entry
- 18364 third-party-advisory
- 20060104 Another WMF exploit workaround mailing-list
- 18415 third-party-advisory
- 20060101 Re: RE: WMF Exploit mailing-list
- 20060103 Re: [funsec] WMF round-up, updates and de-mystification mailing-list
- 20060103 WMF round-up, updates and de-mystification mailing-list
- 18311 third-party-advisory
- TA05-362A third-party-advisory
- http://linuxbox.org/pipermail/funsec/2006-January/002455.html
- 20051229 RE: WMF Exploit mailing-list
- oval:org.mitre.oval:def:1431 vdb-entry signature
- 20051227 Is this a new exploit? mailing-list
- VU#181038 third-party-advisory
- oval:org.mitre.oval:def:1460 vdb-entry signature
- 16074 vdb-entry
- http://www130.nortelnetworks.com/cgi-bin/eserv/cs/main.jsp?cscat=BLTNDETAIL&DocumentOID=375341
- MS06-001 vendor-advisory
- 20060103 WMF SETABORTPROC exploit mailing-list
- oval:org.mitre.oval:def:1433 vdb-entry signature
- TA06-005A third-party-advisory
- http://support.avaya.com/elmodocs2/security/ASA-2006-001.htm
- http://www.microsoft.com/technet/security/advisory/912840.mspx
- http://www130.nortelnetworks.com/cgi-bin/eserv/cs/main.jsp?cscat=BLTNDETAIL&DocumentOID=375420