Signature Detail

SMTP: .ANI

This signature detects e-mail attachments that have the extension .ANI (animated cursors) and were sent through SMTP. A vulnerability exists in the way Windows parses ANI and cursor file headers. Attackers can create malicious icon files, tricking users into opening or viewing the file and infecting the system.

Extended Description

Microsoft Windows is prone to a denial of service when processing specially formed ANI files. The Windows kernel fails to perform proper sanitization on the frame or rate number set in the ANI file header, which may result in a system crash.

Affected Products

• Microsoft windows_2000_advanced_server SP1
• Microsoft windows_2000_advanced_server SP2
• Microsoft windows_2000_advanced_server SP3
• Microsoft windows_2000_advanced_server SP4
• Microsoft windows_2000_advanced_server
• Microsoft windows_2000_datacenter_server SP1
• Microsoft windows_2000_datacenter_server SP2
• Microsoft windows_2000_datacenter_server SP3
• Microsoft windows_2000_datacenter_server SP4
• Microsoft windows_2000_datacenter_server
• Microsoft windows_2000_professional SP1
• Microsoft windows_2000_professional SP2
• Microsoft windows_2000_professional SP3
• Microsoft windows_2000_professional SP4
• Microsoft windows_2000_professional
• Microsoft windows_2000_server SP1
• Microsoft windows_2000_server SP2
• Microsoft windows_2000_server SP3
• Microsoft windows_2000_server SP4
• Microsoft windows_2000_server
• Microsoft windows_2000_server_japanese_edition
• Microsoft windows_2000_terminal_services SP1
• Microsoft windows_2000_terminal_services SP2
• Microsoft windows_2000_terminal_services SP3
• Microsoft windows_2000_terminal_services SP4
• Microsoft windows_2000_terminal_services
• Microsoft windows_98
• Microsoft windows_98se
• Microsoft windows_me
• Microsoft windows_nt 3.5
• Microsoft windows_nt 3.5.1
• Microsoft windows_nt 3.5.1 SP1
• Microsoft windows_nt 3.5.1 SP2
• Microsoft windows_nt 3.5.1 SP3
• Microsoft windows_nt 3.5.1 SP4
• Microsoft windows_nt 3.5.1 SP5
• Microsoft windows_nt 3.5.1 SP5 alpha
• Microsoft windows_nt 4.0
• Microsoft windows_nt 4.0 alpha
• Microsoft windows_nt 4.0 SP1
• Microsoft windows_nt 4.0 SP1 alpha
• Microsoft windows_nt 4.0 SP2
• Microsoft windows_nt 4.0 SP2 alpha
• Microsoft windows_nt 4.0 SP3
• Microsoft windows_nt 4.0 SP3 alpha
• Microsoft windows_nt 4.0 SP4
• Microsoft windows_nt 4.0 SP4 alpha
• Microsoft windows_nt 4.0 SP5
• Microsoft windows_nt 4.0 SP5 alpha
• Microsoft windows_nt 4.0 SP6
• Microsoft windows_nt 4.0 SP6a
• Microsoft windows_nt 4.0 SP6a alpha
• Microsoft windows_nt 4.0 SP6 alpha
• Microsoft windows_nt_enterprise_server 4.0
• Microsoft windows_nt_enterprise_server 4.0 SP1
• Microsoft windows_nt_enterprise_server 4.0 SP2
• Microsoft windows_nt_enterprise_server 4.0 SP3
• Microsoft windows_nt_enterprise_server 4.0 SP4
• Microsoft windows_nt_enterprise_server 4.0 SP5
• Microsoft windows_nt_enterprise_server 4.0 SP6
• Microsoft windows_nt_enterprise_server 4.0 SP6a
• Microsoft windows_nt_server 4.0
• Microsoft windows_nt_server 4.0 SP1
• Microsoft windows_nt_server 4.0 SP2
• Microsoft windows_nt_server 4.0 SP3
• Microsoft windows_nt_server 4.0 SP4
• Microsoft windows_nt_server 4.0 SP5
• Microsoft windows_nt_server 4.0 SP6
• Microsoft windows_nt_server 4.0 SP6a
• Microsoft windows_nt_terminal_server 4.0
• Microsoft windows_nt_terminal_server 4.0 alpha
• Microsoft windows_nt_terminal_server 4.0 SP1
• Microsoft windows_nt_terminal_server 4.0 SP2
• Microsoft windows_nt_terminal_server 4.0 SP3
• Microsoft windows_nt_terminal_server 4.0 SP4
• Microsoft windows_nt_terminal_server 4.0 SP5
• Microsoft windows_nt_terminal_server 4.0 SP6
• Microsoft windows_nt_terminal_server 4.0 SP6a
• Microsoft windows_nt_workstation 4.0
• Microsoft windows_nt_workstation 4.0 SP1
• Microsoft windows_nt_workstation 4.0 SP2
• Microsoft windows_nt_workstation 4.0 SP3
• Microsoft windows_nt_workstation 4.0 SP4
• Microsoft windows_nt_workstation 4.0 SP5
• Microsoft windows_nt_workstation 4.0 SP6
• Microsoft windows_nt_workstation 4.0 SP6a
• Microsoft windows_server_2003_datacenter_x64_edition
• Microsoft windows_server_2003_enterprise_x64_edition
• Microsoft windows_server_2003_standard_edition
• Microsoft windows_server_2003_standard_x64_edition
• Microsoft windows_xp_64-bit_edition SP1
• Microsoft windows_xp_64-bit_edition
• Microsoft windows_xp_64-bit_edition_version_2003 SP1
• Microsoft windows_xp_64-bit_edition_version_2003
• Microsoft windows_xp_embedded SP1
• Microsoft windows_xp_embedded
• Microsoft windows_xp_home SP1
• Microsoft windows_xp_home
• Microsoft windows_xp_media_center_edition SP1
• Microsoft windows_xp_media_center_edition
• Microsoft windows_xp_professional SP1
• Microsoft windows_xp_professional
• Nortel_networks ip_softphone_2050
• Nortel_networks mcs_5100 3.0.0
• Nortel_networks mcs_5200 3.0.0
• Nortel_networks media_processing_server
• Nortel_networks periphonics
• Nortel_networks symposium_agent
• Nortel_networks symposium_call_center_server_(sccs)
• Nortel_networks symposium_express_call_center_(secc)
• Nortel_networks symposium_network_control_center_(ncc)
• Nortel_networks symposium_tapi_service_provider
• Nortel_networks symposium_web_center_portal_(swcp)
• Nortel_networks symposium_web_client

References

• BugTraq: 12094
• CVE: CVE-2004-1305
• URL: http://www.microsoft.com/technet/security/Bulletin/MS05-002.mspx
• URL: http://www.xfocus.net/flashsky/icoExp/index.html
• URL: http://www.daubnet.com/formats/ICO.html