Buffer overflow in Microsoft Windows and Windows Server - CVE-2007-0038

Vulnerability details

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to boundary error when handling cursor, animated cursor, and icon formats. A remote attacker can create a specially crafted malicious cursor or icon file, cause buffer overflow and execute arbitrary code on vulnerable system.

Successful exploitation of the vulnerability results in compromise of vulnerable system.

Note: this vulnerability is being actively exploited.

Affected software

How to mitigate CVE-2007-0038

• Microsoft Windows 2000 Service Pack 4 — Download the update
• Microsoft Windows XP Service Pack 2 — Download the update
• Microsoft Windows XP Professional x64 Edition and Microsoft Windows XP Professional x64 Edition Service Pack 2 — Download the update
• Microsoft Windows Server 2003, Microsoft Windows Server 2003 Service Pack 1, and Microsoft Windows Server 2003 Service Pack 2 — Download the update
• Microsoft Windows Server 2003 for Itanium-based Systems, Microsoft Windows Server 2003 with SP1 for Itanium-based Systems, and Microsoft Windows Server 2003 with SP2 for Itanium-based Systems — Download the update
• Microsoft Windows Server 2003 x64 Edition and Microsoft Windows Server 2003 x64 Edition Service Pack 2 — Download the update
• Windows Vista — Download the update
• Windows Vista x64 Edition — Download the update

Links to Public Exploits and PoC-codes

• Exploit #2242 - cve2007-0038x64 (An attack exploiting CVE 2007-0038 on Windows XP Pro x64 Edition SP1) (March 31, 2020)
• Exploit #595 - Microsoft Windows - Animated Cursor '.ani' Local Overflow (March 18, 2020)
• Exploit #1682 - Windows ANI LoadAniIcon() Chunk Size Stack Buffer Overflow (HTTP) (March 18, 2020)
• Exploit #1653 - Windows ANI LoadAniIcon() Chunk Size Stack Buffer Overflow (SMTP) (March 18, 2020)
• Exploit #600 - Microsoft Windows - Explorer Unspecified .ANI File Denial of Service (March 18, 2020)
• Exploit #599 - Microsoft Windows - Animated Cursor '.ani' Stack Overflow (March 18, 2020)
• Exploit #598 - Microsoft Windows - Animated Cursor '.ani' Local Buffer Overflow (March 18, 2020)
• Exploit #597 - Microsoft Windows - Animated Cursor '.ani' Overflow (Hardware DEP) (March 18, 2020)
• Exploit #596 - Microsoft Windows - GDI Privilege Escalation (MS07-017) (1) (March 18, 2020)
• Exploit #586 - Microsoft Windows - ANI LoadAniIcon() Chunk Size Stack Buffer Overflow (SMTP) (MS07-017) (Metasploit) (March 18, 2020)
• Exploit #594 - Microsoft Windows - GDI Privilege Escalation (MS07-017) (2) (March 18, 2020)
• Exploit #593 - Microsoft Windows XP/Vista - Animated Cursor '.ani' Remote Overflow (March 18, 2020)
• Exploit #592 - Microsoft Windows XP - Animated Cursor '.ani' Remote Overflow (2) (March 18, 2020)
• Exploit #591 - Microsoft Windows - Animated Cursor '.ani' Remote Exploit (eeye patch Bypass) (March 18, 2020)
• Exploit #590 - Microsoft Windows - Animated Cursor '.ani' Universal Exploit Generator (March 18, 2020)
• Exploit #589 - Microsoft Windows - '.ani' GDI Remote Elevation of Privilege Exploit (MS07-017) (March 18, 2020)
• Exploit #588 - Microsoft Windows - Animated Cursor Stack Overflow (March 18, 2020)
• Exploit #587 - Microsoft Windows - ANI LoadAniIcon() Chunk Size Stack Buffer Overflow (HTTP) (MS07-017) (Metasploit) (March 18, 2020)

External References

• https://technet.microsoft.com/library/security/935423
• https://technet.microsoft.com/en-us/library/security/ms07-017.aspx

Related Security Bulletins

• Remote code execution in Microsoft Windows