Executive Summary
Informations | |||
---|---|---|---|
Name | CVE-2007-3034 | First vendor Publication | 2007-08-14 |
Vendor | Cve | Last vendor Modification | 2019-02-26 |
Security-Database Scoring CVSS v3
Cvss vector : N/A | |||
---|---|---|---|
Overall CVSS Score | NA | ||
Base Score | NA | Environmental Score | NA |
impact SubScore | NA | Temporal Score | NA |
Exploitabality Sub Score | NA | ||
Calculate full CVSS 3.0 Vectors scores |
Security-Database Scoring CVSS v2
Cvss vector : (AV:N/AC:M/Au:N/C:C/I:C/A:C) | |||
---|---|---|---|
Cvss Base Score | 9.3 | Attack Range | Network |
Cvss Impact Score | 10 | Attack Complexity | Medium |
Cvss Expoit Score | 8.6 | Authentication | None Required |
Calculate full CVSS 2.0 Vectors scores |
Detail
Integer overflow in the AttemptWrite function in Graphics Rendering Engine (GDI) on Microsoft Windows 2000 SP4, XP SP2, and Server 2003 SP1 allows remote attackers to execute arbitrary code via a crafted metafile (image) with a large record length value, which triggers a heap-based buffer overflow. |
Original Source
Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3034 |
CWE : Common Weakness Enumeration
% | Id | Name |
---|---|---|
100 % | CWE-189 | Numeric Errors (CWE/SANS Top 25) |
OVAL Definitions
Definition Id: oval:org.mitre.oval:def:2088 | |||
Oval ID: | oval:org.mitre.oval:def:2088 | ||
Title: | Remote Code Execution Vulnerability in GDI | ||
Description: | Integer overflow in the AttemptWrite function in Graphics Rendering Engine (GDI) on Microsoft Windows 2000 SP4, XP SP2, and Server 2003 SP1 allows remote attackers to execute arbitrary code via a crafted metafile (image) with a large record length value, which triggers a heap-based buffer overflow. | ||
Family: | windows | Class: | vulnerability |
Reference(s): | CVE-2007-3034 | Version: | 3 |
Platform(s): | Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 | Product(s): | |
Definition Synopsis: | |||
|
CPE : Common Platform Enumeration
Type | Description | Count |
---|---|---|
Os | 1 | |
Os | 2 | |
Os | 1 | |
Os | 2 |
ExploitDB Exploits
id | Description |
---|---|
2008-04-14 | MS Windows GDI - Image Parsing Stack Overflow Exploit (MS08-021) |
2007-08-29 | MS Windows - (GDI32.DLL) Denial of Service Exploit (MS07-046) |
Open Source Vulnerability Database (OSVDB)
Id | Description |
---|---|
36388 | Microsoft Windows Graphics Rendering Engine (GDI) Metafile Image Handling Ove... |
Snort® IPS/IDS
Date | Description |
---|---|
2014-01-10 | Microsoft Windows wmf file arbitrary code execution attempt RuleID : 5318 - Revision : 20 - Type : FILE-MULTIMEDIA |
2016-04-05 | Microsoft Windows GDI metafile integer overflow attempt RuleID : 37879 - Revision : 1 - Type : FILE-IMAGE |
2016-04-05 | Microsoft Windows GDI metafile integer overflow attempt RuleID : 37878 - Revision : 1 - Type : FILE-IMAGE |
2016-04-05 | Microsoft Windows GDI metafile integer overflow attempt RuleID : 37877 - Revision : 1 - Type : FILE-IMAGE |
2016-04-05 | Microsoft Windows GDI metafile integer overflow attempt RuleID : 37876 - Revision : 1 - Type : FILE-IMAGE |
2015-06-03 | Microsoft Windows wmf integer overflow attempt RuleID : 34294 - Revision : 2 - Type : FILE-IMAGE |
2015-06-03 | Microsoft Windows wmf integer overflow attempt RuleID : 34293 - Revision : 2 - Type : FILE-IMAGE |
2014-01-10 | Microsoft Windows wmf integer overflow attempt RuleID : 18583 - Revision : 15 - Type : FILE-IMAGE |
Nessus® Vulnerability Scanner
Date | Description |
---|---|
2007-08-14 | Name : Arbitrary code can be executed on the remote host by sending a malformed file... File : smb_nt_ms07-046.nasl - Type : ACT_GATHER_INFO |
Sources (Detail)
Alert History
Date | Informations |
---|---|
2021-05-04 12:05:53 |
|
2021-04-22 01:06:25 |
|
2020-05-23 00:19:53 |
|
2019-02-26 17:19:30 |
|
2018-10-16 21:19:59 |
|
2018-10-13 00:22:37 |
|
2017-10-11 09:23:59 |
|
2016-04-26 16:12:51 |
|
2015-06-03 21:26:54 |
|
2014-02-17 10:40:26 |
|
2014-01-19 21:24:12 |
|
2013-05-11 10:27:29 |
|