Vulnerability Note VU#633446
Microsoft MSN Messenger GIF processing buffer overflow
MSN Messenger clients before version 7.0 will allow remote attackers to take control of a computer if malicious GIF files are processed.
Microsoft MSN Messenger is an instant messaging application that allows users to collaborate with people using text messages, voice and video communication, or by sending files. There is a buffer overflow vulnerability in a function MSN Messenger uses to process Graphic Interchange Format (GIF) image files. By sending a specially crafted GIF image file with unexpected height and width parameters, a remote attacker in a victim's contacts list could take control of a computer with the privileges of the affected user. Examples of GIF image files MSN Messenger typically processes include emoticons and display pictures.
Please note the updates from Microsoft in MS05-022 addressing this issue supercede those in MS05-009. MSN Messenger 7.0 BETA is affected by this issue.
Remote attackers may execute arbitrary code with the privileges of affected users. Microsoft notes MSN Messenger does not by default anonymous user messages. An attecker must be in a victim's contacts list.
Upgrade to either MSN Messenger 6.2.208 or MSN Messenger 7.0. Note MSN Messenger 7.0 BETA is affected by this issue.
Microsoft has included the following potential workarounds in their technical security bulletin, MS05-022, about this issue:
Systems Affected (Learn More)
|Vendor||Status||Date Notified||Date Updated|
|Microsoft Corporation||Affected||-||12 Apr 2005|
CVSS Metrics (Learn More)
Microsoft has thanked Hongzhen Zhou in technical security bulletin MS05-022.
This document was written by Jeffrey S. Havrilla.
- CVE IDs: CAN-2005-0562
- Date Public: 12 Apr 2005
- Date First Published: 12 Apr 2005
- Date Last Updated: 12 Apr 2005
- Severity Metric: 23.62
- Document Revision: 11
If you have feedback, comments, or additional information about this vulnerability, please send us email.