CVE-2005-2118

Severity

51%

Complexity

49%

Confidentiality

106%

Windows Shell for Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 allows remote user-assisted attackers to execute arbitrary commands via a crafted shortcut (.lnk) file with long font properties that lead to a buffer overflow when the user views the file's properties using Windows Explorer, a different vulnerability than CVE-2005-2122.

Windows Shell for Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 allows remote user-assisted attackers to execute arbitrary commands via a crafted shortcut (.lnk) file with long font properties that lead to a buffer overflow when the user views the file's properties using Windows Explorer, a different vulnerability than CVE-2005-2122.

CVSS 2.0 Base Score 5.1. CVSS Attack Vector: network. CVSS Attack Complexity: high. CVSS Vector: (AV:N/AC:H/Au:N/C:P/I:P/A:P).

Overview

Type

Microsoft

First reported 19 years ago

2005-10-21 18:02:00

Last updated 5 years ago

2019-04-30 14:27:00

Affected Software

Microsoft Windows 2000

Microsoft windows 2000_sp1

Microsoft windows 2000_sp2

Microsoft windows 2000_sp3

Microsoft Windows 2000 Service Pack 4

Microsoft Windows XP Professional Gold

Microsoft Windows XP Service Pack 1 Home Edition

Microsoft windows xp_sp1 media_center

Microsoft windows xp_sp2 tablet_pc

References

17168

Vendor Advisory

17172

Vendor Advisory

17223

Vendor Advisory

1015040

http://support.avaya.com/elmodocs2/security/ASA-2005-214.pdf

http://www.argeniss.com/research/MSBugPaper.pdf

Vendor Advisory

15070

TA05-284A

Third Party Advisory, US Government Resource

MS05-049

oval:org.mitre.oval:def:1116

oval:org.mitre.oval:def:1192

Stay updated

ExploitPedia is constantly evolving. Sign up to receive a notification when we release additional functionality.

Get in touch

If you'd like to report a bug or have any suggestions for improvements then please do get in touch with us using this form. We will get back to you as soon as we can.