Microsoft Windows XP explorer.exe memory corruption

Summaryinfo

A vulnerability identified as critical has been detected in Microsoft Windows XP. The impacted element is an unknown function in the library ntdll.dll of the file explorer.exe. This manipulation causes memory corruption. This vulnerability appears as CVE-2007-5145. There is no available exploit. You should upgrade the affected component.

Detailsinfo

A vulnerability was found in Microsoft Windows XP (Operating System). It has been declared as critical. Affected by this vulnerability is some unknown functionality in the library ntdll.dll of the file explorer.exe. The manipulation with an unknown input leads to a memory corruption vulnerability. The CWE definition for the vulnerability is CWE-119. The product performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer. As an impact it is known to affect availability. The summary by CVE is:

Multiple buffer overflows in system DLL files in Microsoft Windows XP, as used by Microsoft Windows Explorer (explorer.exe) 6.00.2900.2180, Don Ho Notepad++, unspecified Adobe Macromedia applications, and other programs, allow user-assisted remote attackers to cause a denial of service (application crash) via long strings in the (1) author, (2) title, (3) subject, and (4) comment Properties fields of a file, possibly involving improper handling of extended file attributes by the (a) NtQueryInformationFile, (b) NtQueryDirectoryFile, (c) NtSetInformationFile, (d) FileAllInformation, (e) FileNameInformation, and other FILE_INFORMATION_CLASS functions in ntdll.dll and the (f) GetFileAttributesExW and (g) GetFileAttributesW functions in kernel32.dll, a related issue to CVE-2007-1347.

The bug was discovered 03/12/2007. The weakness was presented 06/04/2007 (Website). The advisory is shared at osvdb.org. This vulnerability is known as CVE-2007-5145 since 09/30/2007. The attack can be launched remotely. The exploitation doesn't need any form of authentication. Technical details are known, but no exploit is available.

The vulnerability was handled as a non-public zero-day exploit for at least 84 days. During that time the estimated underground price was around $100k and more.

Upgrading eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at OSVDB (41064†). If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Operating System

Vendor

• Microsoft

Name

• Windows

Version

• XP

License

• commercial

Support

• end of life (old version)

Website

• Vendor: https://www.microsoft.com/
• Product: https://www.microsoft.com/en-us/windows

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion