Description
Stack-based buffer overflow in GDI in Microsoft Windows 2000 SP4, XP SP2, Server 2003 SP1 and SP2, Vista, and Server 2008 allows remote attackers to execute arbitrary code via an EMF image file with crafted filename parameters, aka "GDI Stack Overflow Vulnerability."
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 2
- Microsoft Windows - GDI (EMR_COLORMATCHTOTARGETW) (MS08-021) EDB-6656 · remote · Oct 2, 2008 · verified
- Microsoft Windows - GDI Image Parsing Stack Overflow (MS08-021) EDB-5442 · local · Apr 14, 2008 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- 44215 vdb-entry
- TA08-099A third-party-advisory
- SSRT080048 vendor-advisory
- ADV-2008-1145 vdb-entry
- MS08-021 vendor-advisory
- 28570 vdb-entry
- oval:org.mitre.oval:def:5580 vdb-entry signature
- 6656 exploit
- 5442 exploit
- 1019798 vdb-entry
- 29704 third-party-advisory