vulnwire
6.5med

CVE-2005-21203 exploits

Stack-based buffer overflow in the Plug and Play (PnP) service (UMPNPMGR.DLL) in Microsoft Windows 2000 SP4, and XP SP1 and SP2, allows rem…

Published 21 y ago · modified 4 mo ago · JSON

CVSS
6.5
v2.0 · NVD
CISA KEV
No
not known exploited
EPSS
62.0%
percentile 99%
Public exploits
3
Metasploit · Exploit-DB

Stack-based buffer overflow in the Plug and Play (PnP) service (UMPNPMGR.DLL) in Microsoft Windows 2000 SP4, and XP SP1 and SP2, allows remote or local authenticated attackers to execute arbitrary code via a large number of "\" (backslash) characters in a registry key name, which triggers the overflow in a wsprintfW function call.

Exploit prediction (EPSS)

61.97% probability of exploitation in the next 30 days, higher than 99% of all scored CVEs.

Exploits and detections

  • Metasploit auxiliary/dos/windows/smb/ms05_047_pnp Microsoft Plug and Play Service Registry Overflow · metasploit auxiliary, normal rank
  • EDB-1271 Microsoft Windows Plug-and-Play - 'Umpnpmgr.dll' Denial of Service (MS05-047) (2) · dos · 2005-10-24
  • EDB-1269 Microsoft Windows Plug-and-Play - 'Umpnpmgr.dll' Denial of Service (MS05-047) (1) · dos · 2005-10-21

CVSS scores

Assigned byVersionScoreVector
NVD2.06.5AV:N/AC:L/Au:S/C:P/I:P/A:P

References

  • securityfocus.com /bid/15065 · vdb-entry, x_refsource_BID, x_transferred
  • secunia.com /advisories/17166 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • docs.microsoft.com /en-us/security-updates/securitybulletins/2005/ms05-047 · vendor-advisory, x_refsource_MS, x_transferred
  • support.avaya.com /elmodocs2/security/ASA-2005-214.pdf · x_refsource_CONFIRM, x_transferred
  • secunia.com /advisories/17223 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • oval.cisecurity.org /repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1244 · vdb-entry, signature, x_refsource_OVAL, x_transferred
  • securitytracker.com /id?1015042 · vdb-entry, x_refsource_SECTRACK, x_transferred
  • eeye.com /html/research/advisories/AD20051011c.html · third-party-advisory, x_refsource_EEYE, x_transferred
  • securityreason.com /securityalert/71 · third-party-advisory, x_refsource_SREASON, x_transferred
  • osvdb.org /18830 · vdb-entry, x_refsource_OSVDB, x_transferred
  • secunia.com /advisories/17172 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • kb.cert.org /vuls/id/214572 · third-party-advisory, x_refsource_CERT-VN, x_transferred
  • oval.cisecurity.org /repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1328 · vdb-entry, signature, x_refsource_OVAL, x_transferred
  • oval.cisecurity.org /repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1519 · vdb-entry, signature, x_refsource_OVAL, x_transferred
  • us-cert.gov /cas/techalerts/TA05-284A.html · third-party-advisory, x_refsource_CERT, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.