CVE-2007-1765
published 2007-03-30CVE-2007-1765: Unspecified vulnerability in Microsoft Windows 2000 SP4 through Vista allows remote attackers to execute arbitrary code or cause a denial of service…
PriorityP270critical9.3CVSS 2.0
AVNACMAuNCCICAC
ITWEXPLOITVulnCheck KEV
Exploited in the wild
EPSS
54.60%
99.0th percentile
Unspecified vulnerability in Microsoft Windows 2000 SP4 through Vista allows remote attackers to execute arbitrary code or cause a denial of service (persistent reboot) via a malformed ANI file, which results in memory corruption when processing cursors, animated cursors, and icons, a similar issue to CVE-2005-0416, as originally demonstrated using Internet Explorer 6 and 7. NOTE: this issue might be a duplicate of CVE-2007-0038; if so, then use CVE-2007-0038 instead of this identifier.
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | ie | — | — |
| microsoft | internet_explorer | <= 6 | — |
| microsoft | windows_2003_server | — | — |
| microsoft | windows_2003_server | — | — |
| microsoft | windows_2003_server | — | — |
Detection & IOCsextracted from sources · hover to see the quote
bytes↗
52 49 46 46 ?? ?? ?? ?? 41 43 4F 4E 61 6E 69 68
bytes↗
52 49 46 46 08 4D 00 00 41 43 4F 4E 61 6E 69 68
bytes↗
52 49 46 46 13 03 00 00 41 43 4F 4E 61 6E 69 68
- →Exploit delivery via HTTP server serving malicious .ANI files; the HTML page references the ANI via CSS cursor property: `* {CURSOR: url("poc.ani")}`. Monitor for HTML pages loading .ani files via CSS cursor rules. ↗
- →Exploit uses ret2libc technique targeting msvcrt.dll system() (0x77C293C7 on XP SP2) and a kernel32.dll ROP gadget (0x7C8024D6 on XP SP2) to bypass Hardware DEP. Monitor for unusual call chains from user32.dll into msvcrt system(). ↗
- →Exploit for XP SP2 uses JMP ESP gadget at 0x7C941EED in ntdll.dll. Monitor for return addresses pointing into ntdll at this offset during ANI file processing. ↗
- →Exploit for XP SP2 uses CALL ESI gadget at 0x7C801A7B in kernel32.dll. Monitor for return addresses pointing into kernel32 at this offset during ANI file processing. ↗
- →The Python-based exploit HTTP server (exploit 4045) serves malicious ANI files with Content-Type: application/octetstream. Detect HTTP responses with this content type delivering RIFF/ACON files. ↗
- →Exploit embeds a windows/shell_reverse_tcp Metasploit payload (287 bytes, EXITFUNC=seh). The shellcode connects back to attacker on port 1234. Monitor for outbound connections on port 1234 from browser/explorer processes after ANI file rendering. ↗
- ·The CVE-2007-1765 identifier may be a duplicate of CVE-2007-0038; defenders should cross-reference both CVEs when applying patches or writing detection rules. ↗
- ·The ret2libc ROP gadget addresses (kernel32.dll, msvcrt.dll, ntdll.dll) are version-specific and differ across Windows XP SP1, SP2, and Windows Server 2003. Detection rules using hardcoded addresses should account for all listed variants. ↗
CVSS provenance
nvdv2.09.3CRITICALAV:N/AC:M/Au:N/C:C/I:C/A:C
vulncheck7.5HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-p2h6-rq92-jmvq: Stack-based buffer overflow in the animated cursor code in Microsoft Windows 2000 SP4 through Vista allows remote attackers to execute arbitrary code
ghsa_unreviewed·2022-05-01·CVSS 7.5
CVE-2007-0038 [HIGH] CWE-119 GHSA-p2h6-rq92-jmvq: Stack-based buffer overflow in the animated cursor code in Microsoft Windows 2000 SP4 through Vista allows remote attackers to execute arbitrary code
Stack-based buffer overflow in the animated cursor code in Microsoft Windows 2000 SP4 through Vista allows remote attackers to execute arbitrary code or cause a denial of service (persistent reboot) via a large length value in the second (or later) anih block of a RIFF .ANI, cur, or .ico file, which results in memory corruption when processing cursors, animated cursors, and icons, a variant of CVE-2005-0416, as originally demonstrated using Internet Explorer 6 and 7. NOTE: this might be a duplicate of CVE-2007-1765; if so, then CVE-2007-0038 should be preferred.
GHSA
GHSA-f56g-48jx-gg6q: Unspecified vulnerability in Microsoft Windows 2000 SP4 through Vista allows remote attackers to execute arbitrary code or cause a denial of service (
ghsa_unreviewed·2022-05-01·CVSS 7.5
CVE-2007-1765 [HIGH] GHSA-f56g-48jx-gg6q: Unspecified vulnerability in Microsoft Windows 2000 SP4 through Vista allows remote attackers to execute arbitrary code or cause a denial of service (
Unspecified vulnerability in Microsoft Windows 2000 SP4 through Vista allows remote attackers to execute arbitrary code or cause a denial of service (persistent reboot) via a malformed ANI file, which results in memory corruption when processing cursors, animated cursors, and icons, a similar issue to CVE-2005-0416, as originally demonstrated using Internet Explorer 6 and 7. NOTE: this issue might be a duplicate of CVE-2007-0038; if so, then use CVE-2007-0038 instead of this identifier.
VulnCheck
Microsoft Windows Cursor, Animated Cursor, and Icon Processing Vulnerability
vulncheck·2007·CVSS 7.5
CVE-2007-1765 [HIGH] Microsoft Windows Cursor, Animated Cursor, and Icon Processing Vulnerability
Microsoft Windows Cursor, Animated Cursor, and Icon Processing Vulnerability
Unspecified vulnerability in Microsoft Windows 2000 SP4 through Vista allows remote attackers to execute arbitrary code or cause a denial of service (persistent reboot) via a malformed ANI file, which results in memory corruption when processing cursors, animated cursors, and icons, a similar issue to CVE-2005-0416, as originally demonstrated using Internet Explorer 6 and 7. NOTE: this issue might be a duplicate of CVE-2007-0038; if so, then use CVE-2007-0038 instead of this identifier.
Affected: Microsoft Windows
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://archive.f-
VulnCheck
Microsoft Windows Improper Restriction of Operations within the Bounds of a Memory Buffer
vulncheck·2007·CVSS 7.5
CVE-2007-0038 [HIGH] Microsoft Windows Improper Restriction of Operations within the Bounds of a Memory Buffer
Microsoft Windows Improper Restriction of Operations within the Bounds of a Memory Buffer
Stack-based buffer overflow in the animated cursor code in Microsoft Windows 2000 SP4 through Vista allows remote attackers to execute arbitrary code or cause a denial of service (persistent reboot) via a large length value in the second (or later) anih block of a RIFF .ANI, cur, or .ico file, which results in memory corruption when processing cursors, animated cursors, and icons, a variant of CVE-2005-0416, as originally demonstrated using Internet Explorer 6 and 7. NOTE: this might be a duplicate of CVE-2007-1765; if so, then CVE-2007-0038 should be preferred.
Affected: Microsoft Windows
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product i
No detection rules found.
Exploit-DB
Microsoft Windows - ANI LoadAniIcon() Chunk Size Stack Buffer Overflow (SMTP) (MS07-017) (Metasploit)
exploitdb·2010-09-20
CVE-2007-1765 Microsoft Windows - ANI LoadAniIcon() Chunk Size Stack Buffer Overflow (SMTP) (MS07-017) (Metasploit)
Microsoft Windows - ANI LoadAniIcon() Chunk Size Stack Buffer Overflow (SMTP) (MS07-017) (Metasploit)
---
##
# $Id: ms07_017_ani_loadimage_chunksize.rb 10394 2010-09-20 08:06:27Z jduck $
##
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##
require 'msf/core'
class Metasploit3 'Windows ANI LoadAniIcon() Chunk Size Stack Buffer Overflow (SMTP)',
'Description' => %q{
This module exploits a buffer overflow vulnerability in the
LoadAniIcon() function of USER32.dll. The flaw is triggered
through Outlook Express by using the CURSOR style sheet
directive to load a malicious .ANI file.
Th
Exploit-DB
Microsoft Windows - Animated Cursor Stack Overflow
exploitdb·2007-06-07
CVE-2007-0038 Microsoft Windows - Animated Cursor Stack Overflow
Microsoft Windows - Animated Cursor Stack Overflow
---
#!/usr/bin/env python
#
# $Id: win32-loadaniicon.py 4 2007-06-02 00:47:59Z ramon $
#
# Windows Animated Cursor Stack Overflow Exploit
# Copyright 2007 Ramon de Carvalho Valle ,
# RISE Security
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 2 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General P
Exploit-DB
Microsoft Windows - Animated Cursor '.ani' Local Overflow
exploitdb·2007-04-09
CVE-2007-0038 Microsoft Windows - Animated Cursor '.ani' Local Overflow
Microsoft Windows - Animated Cursor '.ani' Local Overflow
---
/*
.ANI exploit tested on Windows XP SP2 - Portuguese
Shellcode port bind 13579
JMP ESP Addr - ntdll.dll
Greetz: Marsu, Devcode, Str0ke, Dave, Sekure.org guys, Sauna.
Exploit coded listen sauna hits
Featuring Luiz Zanardo's gigs "Minoide - \x52\x49\x46\x46\x00\x04\x00\x41" @ www.myspace.com/fuzzyproject
Breno Silva Pinto
bsilva[at]Sekure.org
*/
#include
#include
#include
unsigned char aniheader[] =
"\x52\x49\x46\x46\x00\x04\x00\x00\x41\x43\x4F\x4E\x61\x6E\x69\x68"
"\x24\x00\x00\x00\x24\x00\x00\x00\xFF\xFF\x00\x00\x0A\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x10\x00\x00\x00\x01\x00\x00\x00\x54\x53\x49\x4C\x03\x00\x00\x00"
"\x10\x00\x00\x00\x54\x53\x49\x4C\x03\x00\x00\x00\x02\x02
Exploit-DB
Microsoft Windows Explorer - '.ANI' File Denial of Service
exploitdb·2007-04-08
CVE-2007-0038 Microsoft Windows Explorer - '.ANI' File Denial of Service
Microsoft Windows Explorer - '.ANI' File Denial of Service
---
/****************************************************************************
* MS Windows Explorer Unspecified .ANI File DoS *
* *
* *
* Another .Ani bug that freezes Explorer if you open a folder that contains *
* a crafted file. *
* *
* Tested against Win XP SP2 FR. *
* Have Fun! *
* *
* Coded by Marsu *
****************************************************************************/
#include "stdio.h"
#include "stdlib.h"
unsigned char Ani_headers[] =
"\x52\x49\x46\x46\x08\x4d\x00\x00\x41\x43\x4f\x4e\x61\x6e\x69\x68"
"\x24\x00\x00\x00\x24\x00\x00\x00\x06\x00\x00\x00\x06\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x04\x00\x00\x00\x01\x00\x00\x00"
"\x0a\x00\x00\x00\x01\x00\x00\x00\x72\x61\x74\x65\x18\x00\x00\x00"
"\x03\x00
Exploit-DB
Microsoft Windows - Animated Cursor '.ani' Local Overflow (Hardware DEP)
exploitdb·2007-04-03·CVSS 9.3
CVE-2007-1765 [CRITICAL] Microsoft Windows - Animated Cursor '.ani' Local Overflow (Hardware DEP)
Microsoft Windows - Animated Cursor '.ani' Local Overflow (Hardware DEP)
---
/*
* version 0.5
* Copyright (c) 2007 devcode
*
*
* ^^ D E V C O D E ^^
*
* Windows .ANI LoadAniIcon Stack Overflow For Hardware DEP XP SP2
* [CVE-2007-1765]
*
*
* Description:
* A vulnerability has been identified in Microsoft Windows,
* which could be exploited by remote attackers to take complete
* control of an affected system. This issue is due to a stack overflow
* error within the "LoadAniIcon()" [user32.dll] function when rendering
* cursors, animated cursors or icons with a malformed header, which could
* be exploited by remote attackers to execute arbitrary commands by
* tricking a user into visiting a malicious web page or viewing an email
* message containing a specially crafted ANI file.
*
* Hotfix/
Exploit-DB
Microsoft Windows - Animated Cursor '.ani' Universal Generator
exploitdb·2007-04-03
CVE-2007-0038 Microsoft Windows - Animated Cursor '.ani' Universal Generator
Microsoft Windows - Animated Cursor '.ani' Universal Generator
---
#--------------------------------------------------------------------------------
# Info: .ANI (RIFF Cursors) 2007 universal exploit generator
# Tested on MS Internet Explorer 6.x-7.x, Windows XP SP2, Windows Vista
# Author: Yag Kohha
# 10x`n`Gr33tz 2:
# Jamikazu, Skylined (pretty good t-short on BH07 Europe - L00k like skylined, skylined, skylined)
# H.D. Moor and metasploit project
# Kumar Brothers (tnx for Vista patch live show at BH07 Europe),
# Alexander Sotirov (tnx for "Heap Feng Shui" live show at BH07 Europe), str0ke
# Microsoft for great coding and Amsterdam (BH07 Europe) party
#--------------------------------------------------------------------------------
https://gitlab.com/exploit-database/exploitdb-bin-spl
Exploit-DB
Microsoft Windows - Animated Cursor '.ani' Local Buffer Overflow
exploitdb·2007-04-02
CVE-2007-0038 Microsoft Windows - Animated Cursor '.ani' Local Buffer Overflow
Microsoft Windows - Animated Cursor '.ani' Local Buffer Overflow
---
/***************************************************************************
* MS Windows .ANI File Local Buffer Overflow *
* *
* *
* Credits go to Trirat Puttaraksa cause his PoC inspired this source. *
* devcode's exploit didnt work for me, so I made my own. *
* This exploit launches calc.exe on a lot of app (Word, Winamp, etc...). * *
* Turn off DEP to get it work on Explorer. *
* *
* Tested against Win XP SP2 FR. *
* Have Fun! *
* *
* Coded by Marsu *
***************************************************************************/
#include "stdio.h"
#include "stdlib.h"
/* win32_exec - EXITFUNC=process CMD=calc.exe Size=164 Encoder=PexFnstenvSub http://metasploit.com */
unsigned char CalcShellcode[] =
"\x29\xc9\x83\xe9
Exploit-DB
Microsoft Windows XP - Animated Cursor '.ani' Remote Overflow (2)
exploitdb·2007-04-01
CVE-2007-1765 Microsoft Windows XP - Animated Cursor '.ani' Remote Overflow (2)
Microsoft Windows XP - Animated Cursor '.ani' Remote Overflow (2)
---
Microsoft ANI Buffer Overflow Exploit
Author: Trirat Puttaraksa
http://sf-freedom.blogspot.com
Tested on: Windows XP SP2 fully patched + IE 6 SP2
For educational purpose only
There are many confuses about this vulnerability. Someone said that this could
not be exploited in XP SP2 - that's wrong. I provide this exploit because I
wanna to tell these people that they are in danger.
This exploit will call calc.exe (shellcode fome metasploit win32_exec
CMD=calc.exe EXITFUNC=process).
P.S. I do not include the source code for generate the .ani file because of
its damage. However, if you reverse engineer .ani file, you will know how
could I produce this exploit in 10 minutes.
I will describe this vulnerability and how t
Exploit-DB
Microsoft Windows - Animated Cursor '.ani' Remote (eeye patch Bypass)
exploitdb·2007-04-01
CVE-2007-1765 Microsoft Windows - Animated Cursor '.ani' Remote (eeye patch Bypass)
Microsoft Windows - Animated Cursor '.ani' Remote (eeye patch Bypass)
---
..::[ jamikazu presents ]::..
Windows Animated Cursor Handling Exploit (0day) (Version3)
Works on fully patched Windows Vista
I think it is first real remote code execution exploit on vista =)
Tested on:
Windows Vista Enterprise Version 6.0 (Build 6000) (default installation and UAC enabled)
Windows Vista Ultimate Version 6.0 (Build 6000) (default installation and UAC enabled)
Windows XP SP2
(It also must to work on all nt based windows but not tested)
Update: It also bypass eeye security ani patch!
Author: jamikazu
Mail: [email protected]
Bug discovered by determina (http://www.determina.com)
Credit: milw0rm,metasploit, SkyLined, http://doctus.net/
invokes calc.exe if successful
https://gitlab.com/exploi
Exploit-DB
Microsoft Windows XP/Vista - Animated Cursor '.ani' Remote Overflow
exploitdb·2007-04-01
CVE-2007-1765 Microsoft Windows XP/Vista - Animated Cursor '.ani' Remote Overflow
Microsoft Windows XP/Vista - Animated Cursor '.ani' Remote Overflow
---
..::[ jamikazu presents ]::..
Windows Animated Cursor Handling Exploit (0day)
Works on fully patched Windows Vista
I think it is first real remote code execution exploit on vista =)
Tested on:
Windows Vista Enterprise Version 6.0 (Build 6000) (default installation and UAC enabled)
Windows Vista Ultimate Version 6.0 (Build 6000) (default installation and UAC enabled)
Windows XP SP2
(It also must to work on all nt based windows but not tested)
Author: jamikazu
Mail: [email protected]
Bug discovered by determina (http://www.determina.com)
Credit: milw0rm,metasploit, SkyLined, http://doctus.net/
invokes calc.exe if successful
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/3634.
Exploit-DB
Microsoft Windows - Animated Cursor '.ani' Local Stack Overflow
exploitdb·2007-03-31·CVSS 9.3
CVE-2007-1765 [CRITICAL] Microsoft Windows - Animated Cursor '.ani' Local Stack Overflow
Microsoft Windows - Animated Cursor '.ani' Local Stack Overflow
---
/*
* Copyright (c) 2007 devcode
*
*
* ^^ D E V C O D E ^^
*
* Windows .ANI LoadAniIcon Stack Overflow
* [CVE-2007-1765]
*
*
* Description:
* A vulnerability has been identified in Microsoft Windows,
* which could be exploited by remote attackers to take complete
* control of an affected system. This issue is due to a stack overflow
* error within the "LoadAniIcon()" [user32.dll] function when rendering
* cursors, animated cursors or icons with a malformed header, which could
* be exploited by remote attackers to execute arbitrary commands by
* tricking a user into visiting a malicious web page or viewing an email
* message containing a specially crafted ANI file.
*
* Hotfix/Patch:
* None as of this time.
*
* Vulnerable s
Metasploit
Windows ANI LoadAniIcon() Chunk Size Stack Buffer Overflow (SMTP)
metasploit
Windows ANI LoadAniIcon() Chunk Size Stack Buffer Overflow (SMTP)
Windows ANI LoadAniIcon() Chunk Size Stack Buffer Overflow (SMTP)
This module exploits a buffer overflow vulnerability in the LoadAniIcon() function of USER32.dll. The flaw is triggered through Outlook Express by using the CURSOR style sheet directive to load a malicious .ANI file. This vulnerability was discovered by Alexander Sotirov of Determina and was rediscovered, in the wild, by McAfee.
No writeups or analysis indexed.
http://asert.arbornetworks.com/2007/03/any-ani-file-could-infect-you/http://research.eeye.com/html/alerts/zeroday/20070328.htmlhttp://vil.nai.com/vil/content/v_141860.htmhttp://www.avertlabs.com/research/blog/?p=230http://www.avertlabs.com/research/blog/?p=233http://www.microsoft.com/technet/security/advisory/935423.mspxhttp://www.securityfocus.com/archive/1/464287/100/0/threadedhttp://www.securityfocus.com/archive/1/464345/100/0/threadedhttp://www.securityfocus.com/bid/23194http://www.securitytracker.com/id?1017827http://www.vupen.com/english/advisories/2007/1151http://asert.arbornetworks.com/2007/03/any-ani-file-could-infect-you/http://research.eeye.com/html/alerts/zeroday/20070328.htmlhttp://vil.nai.com/vil/content/v_141860.htmhttp://www.avertlabs.com/research/blog/?p=230http://www.avertlabs.com/research/blog/?p=233http://www.microsoft.com/technet/security/advisory/935423.mspxhttp://www.securityfocus.com/archive/1/464287/100/0/threadedhttp://www.securityfocus.com/archive/1/464345/100/0/threadedhttp://www.securityfocus.com/bid/23194http://www.securitytracker.com/id?1017827http://www.vupen.com/english/advisories/2007/1151
2007-03-30
Published
Exploited in the wild