Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2007-1765: Windows and Avaya servers may reboot or run code via crafted cursor file

CVE-2007-1765 · published 19 years ago

Summary

A specially crafted animated cursor (ANI) file can cause memory errors in Windows 2000, XP, Vista, Windows Server 2003 and Avaya IP600 media servers. This can let a remote attacker make the system restart repeatedly or execute their own programs. Apply the latest security updates from Microsoft and Avaya, and avoid opening untrusted cursor files.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
microsoft	windows_2000	All versions `cpe:2.3:o:microsoft:windows_2000:::::advanced_server:::*`
microsoft	windows_2003_server	All versions `cpe:2.3:o:microsoft:windows_2003_server:-::::datacenter:::`
microsoft	windows_vista	All versions `cpe:2.3:o:microsoft:windows_vista:::::::x86:*`
microsoft	windows_xp	All versions `cpe:2.3:o:microsoft:windows_xp::sp2:::home:::`
avaya	ip600_media_servers	All versions `cpe:2.3:a:avaya:ip600_media_servers::::::::`
microsoft	ie	7.0 `cpe:2.3:a:microsoft:ie:7.0::vista:::::`
microsoft	internet_explorer	<= 6 `cpe:2.3:a:microsoft:internet_explorer::::::::`
avaya	definity_one_media_server	All versions `cpe:2.3:h:avaya:definity_one_media_server::::::::`
avaya	s3400	All versions `cpe:2.3:h:avaya:s3400::::::::`
avaya	s8100	All versions `cpe:2.3:h:avaya:s8100::::::::`

Original advisory text

Unspecified vulnerability in Microsoft Windows 2000 SP4 through Vista allows remote attackers to execute arbitrary code or cause a denial of service (persistent reboot) via a malformed ANI file, which results in memory corruption when processing cursors, animated cursors, and icons, a similar issue to CVE-2005-0416, as originally demonstrated using Internet Explorer 6 and 7. NOTE: this issue might be a duplicate of CVE-2007-0038; if so, then use CVE-2007-0038 instead of this identifier.

References

http://asert.arbornetworks.com/2007/03/any-ani-file-could-infect-you/ Broken Link
http://research.eeye.com/html/alerts/zeroday/20070328.html Third Party Advisory
http://vil.nai.com/vil/content/v_141860.htm Broken Link
http://www.avertlabs.com/research/blog/?p=230 Third Party Advisory
http://www.avertlabs.com/research/blog/?p=233 Third Party Advisory
http://www.microsoft.com/technet/security/advisory/935423.mspx Vendor Advisory
http://www.securityfocus.com/archive/1/464287/100/0/threaded
http://www.securityfocus.com/archive/1/464345/100/0/threaded
http://www.securityfocus.com/bid/23194 Third Party Advisory VDB Entry
http://www.securitytracker.com/id?1017827 Third Party Advisory VDB Entry
http://www.vupen.com/english/advisories/2007/1151 Third Party Advisory

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker full control (estimated)

Severity

9.3 Critical

Exploitation

55% chance of attack within 30 days

Timeline

Published30 Mar 2007

Updated27 Oct 2026

First seen29 Sep 2026

Sources

CVE-2007-1765 · NVD

Track software like this

Free during beta