CVE-2005-0416
Summary
| CVE | CVE-2005-0416 |
|---|---|
| State | PUBLISHED |
| Assigner | mitre |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2005-04-27 04:00:00 UTC |
| Updated | 2025-04-03 01:03:51 UTC |
| Description | The Windows Animated Cursor (ANI) capability in Windows NT, Windows 2000 through SP4, Windows XP through SP1, and Windows 2003 allows remote attackers to execute arbitrary code via the AnimationHeaderBlock length field, which leads to a stack-based buffer overflow. |
Risk And Classification
Primary CVSS: v2.0 7.5 from [email protected]
AV:N/AC:L/Au:N/C:P/I:P/A:P
Problem Types: NVD-CWE-Other | n/a
CVSS v2.0 Breakdown
Access Vector
NetworkAccess Complexity
LowAuthentication
NoneConfidentiality
PartialIntegrity
PartialAvailability
PartialAV:N/AC:L/Au:N/C:P/I:P/A:P
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Operating System | Microsoft | Windows 2000 | All | All | All | All |
| Operating System | Microsoft | Windows 2000 | All | sp1 | All | All |
| Operating System | Microsoft | Windows 2000 | All | sp2 | All | All |
| Operating System | Microsoft | Windows 2000 | All | sp3 | All | All |
| Operating System | Microsoft | Windows 2000 | All | sp4 | All | All |
| Operating System | Microsoft | Windows 2003 Server | enterprise | All | 64-bit | All |
| Operating System | Microsoft | Windows 2003 Server | enterprise_64-bit | All | All | All |
| Operating System | Microsoft | Windows 2003 Server | r2 | All | 64-bit | All |
| Operating System | Microsoft | Windows 2003 Server | r2 | All | datacenter_64-bit | All |
| Operating System | Microsoft | Windows 2003 Server | standard | All | 64-bit | All |
| Operating System | Microsoft | Windows 2003 Server | web | All | All | All |
| Operating System | Microsoft | Windows 98 | All | gold | All | All |
| Operating System | Microsoft | Windows 98se | All | All | All | All |
| Operating System | Microsoft | Windows Me | All | All | All | All |
| Operating System | Microsoft | Windows Nt | 4.0 | All | enterprise_server | All |
| Operating System | Microsoft | Windows Nt | 4.0 | All | server | All |
| Operating System | Microsoft | Windows Nt | 4.0 | All | terminal_server | All |
| Operating System | Microsoft | Windows Nt | 4.0 | All | workstation | All |
| Operating System | Microsoft | Windows Nt | 4.0 | sp1 | enterprise_server | All |
| Operating System | Microsoft | Windows Nt | 4.0 | sp1 | server | All |
| Operating System | Microsoft | Windows Nt | 4.0 | sp1 | terminal_server | All |
| Operating System | Microsoft | Windows Nt | 4.0 | sp1 | workstation | All |
| Operating System | Microsoft | Windows Nt | 4.0 | sp2 | enterprise_server | All |
| Operating System | Microsoft | Windows Nt | 4.0 | sp2 | server | All |
| Operating System | Microsoft | Windows Nt | 4.0 | sp2 | terminal_server | All |
| Operating System | Microsoft | Windows Nt | 4.0 | sp2 | workstation | All |
| Operating System | Microsoft | Windows Nt | 4.0 | sp3 | enterprise_server | All |
| Operating System | Microsoft | Windows Nt | 4.0 | sp3 | server | All |
| Operating System | Microsoft | Windows Nt | 4.0 | sp3 | terminal_server | All |
| Operating System | Microsoft | Windows Nt | 4.0 | sp3 | workstation | All |
| Operating System | Microsoft | Windows Nt | 4.0 | sp4 | enterprise_server | All |
| Operating System | Microsoft | Windows Nt | 4.0 | sp4 | server | All |
| Operating System | Microsoft | Windows Nt | 4.0 | sp4 | terminal_server | All |
| Operating System | Microsoft | Windows Nt | 4.0 | sp4 | workstation | All |
| Operating System | Microsoft | Windows Nt | 4.0 | sp5 | enterprise_server | All |
| Operating System | Microsoft | Windows Nt | 4.0 | sp5 | server | All |
| Operating System | Microsoft | Windows Nt | 4.0 | sp5 | terminal_server | All |
| Operating System | Microsoft | Windows Nt | 4.0 | sp5 | workstation | All |
| Operating System | Microsoft | Windows Nt | 4.0 | sp6 | enterprise_server | All |
| Operating System | Microsoft | Windows Nt | 4.0 | sp6 | server | All |
| Operating System | Microsoft | Windows Nt | 4.0 | sp6 | terminal_server | All |
| Operating System | Microsoft | Windows Nt | 4.0 | sp6 | workstation | All |
| Operating System | Microsoft | Windows Nt | 4.0 | sp6a | enterprise_server | All |
| Operating System | Microsoft | Windows Nt | 4.0 | sp6a | server | All |
| Operating System | Microsoft | Windows Nt | 4.0 | sp6a | workstation | All |
| Operating System | Microsoft | Windows Xp | All | All | 64-bit | All |
| Operating System | Microsoft | Windows Xp | All | All | embedded | All |
| Operating System | Microsoft | Windows Xp | All | All | home | All |
| Operating System | Microsoft | Windows Xp | All | All | media_center | All |
| Operating System | Microsoft | Windows Xp | All | gold | professional | All |
| Operating System | Microsoft | Windows Xp | All | sp1 | 64-bit | All |
| Operating System | Microsoft | Windows Xp | All | sp1 | embedded | All |
| Operating System | Microsoft | Windows Xp | All | sp1 | home | All |
| Operating System | Microsoft | Windows Xp | All | sp1 | media_center | All |
| Operating System | Microsoft | Windows Xp | All | sp2 | tablet_pc | All |
Vendor Declared Affected Products
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| IBM X-Force Exchange | af854a3a-2127-422b-91ae-364da2661108 | exchange.xforce.ibmcloud.com | |
| 'EEYE: Windows ANI File Parsing Buffer Overflow' - MARC | af854a3a-2127-422b-91ae-364da2661108 | marc.info | |
| Network Security, Vulnerability Assessment, Intrusion Prevention | af854a3a-2127-422b-91ae-364da2661108 | eeye.com | |
| Microsoft Security Bulletin MS05-002 - Critical | Microsoft Docs | af854a3a-2127-422b-91ae-364da2661108 | docs.microsoft.com | |
| Microsoft Windows User32.DLL ANI File Header Handling Stack-Based Buffer Overflow Vulnerability | af854a3a-2127-422b-91ae-364da2661108 | www.securityfocus.com | Exploit, Patch, Vendor Advisory |
| 'Windows ANI File Parsing Proof Of Concept (MS05-002)' - MARC | af854a3a-2127-422b-91ae-364da2661108 | marc.info | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.