avatar image

Welcome, Guest. Please login or register.
Did you miss your activation email?

Login with username, password and session length
  • December 12, 2018, 12:17 PM
  • Proudly celebrating 13 years online.
  • Donate now to become a lifetime supporting member of the site and get a non-expiring license key for all of our programs.
  • donate

Author Topic: CERT Warning about Animated Cursor Files  (Read 2721 times)


  • Participant
  • Joined in 2006
  • *
  • Posts: 14
    • View Profile
    • Donate to Member
CERT Warning about Animated Cursor Files
« on: March 31, 2007, 01:41 PM »
                        National Cyber Alert System

                  Technical Cyber Security Alert TA07-089A

Microsoft Windows ANI header stack buffer overflow

   Original release date: March 30, 2007
   Last revised: --
   Source: US-CERT

Systems Affected

   Microsoft Windows 2000, XP, Server 2003, and Vista are affected.
   Applications that provide attack vectors include:

     * Microsoft Internet Explorer
     * Microsoft Outlook
     * Microsoft Outlook Express
     * Microsoft Windows Mail
     * Microsoft Windows Explorer


   An unpatched buffer overflow vulnerability in the way Microsoft
   Windows handles animated cursor files is actively being exploited.

I. Description

   A stack buffer overflow exists in the code that Microsoft Windows
   uses to processes animated cursor files. Specifically, Microsoft
   Windows fails to properly validate the size of an animated cursor
   file header supplied in animated cursor files.

   Animated cursor files can be included with HTML files. For
   instance, a web site can use an animated cursor file to specify the
   icon that the mouse pointer should use when hovering over a
   hyperlink. Because of this, malicious web pages and HTML email
   messages can be used to exploit this vulnerability. In addition,
   animated cursor files are automatically parsed by Windows Explorer
   when the containing folder is opened or the file is used as a
   cursor. Because of this, opening a folder that contains a specially
   crafted animated cursor file will also trigger this vulnerability.

   Note that Windows Explorer will process animated cursor files with
   several different file extensions, such as .ani, .cur, or .ico.
   Furthermore, Windows will automatically render animated cursor
   files referenced by HTML documents regardless of the animated
   cursor file extension.

   This vulnerability is actively being exploited.

   More information is available in Vulnerability Note VU#191609.

II. Impact

   A remote, unauthenticated attacker may be able to execute arbitrary
   code. Exploitation may occur when a user clicks a malicious link,
   reads or forwards a specially crafted HTML email, or accesses a
   folder containing a malicious animated cursor file.

III. Solution

   Until a fix is available, refer to the Solution section of
   Vulnerability Note VU#191609 for the latest workarounds.

IV. References

     * Vulnerability Note VU#191609 -

     * Microsoft Security Advisory (935423) -

     * Unpatched Drive-By Exploit Found On The Web -

     * TROJ_ANICHMOO.AX - Description and Solution -


   The most recent version of this document can be found at:


edit by jgpaiva: making links clickable
The Edge... there is no honest way to explain it because the only people who really know where it is are the ones who have gone over.  --  Hunter S. Thompson
« Last Edit: March 31, 2007, 05:42 PM by jgpaiva »