BID:13132

Microsoft Windows Shell Remote Code Execution Vulnerability

Info

Microsoft Windows Shell Remote Code Execution Vulnerability

Bugtraq ID:	13132
Class:	Design Error
CVE:	CVE-2005-0063
Remote:	Yes
Local:	No
Published:	Apr 12 2005 12:00AM
Updated:	Jul 12 2009 12:56PM
Credit:	Discovery is credited to a source that wishes to remain anonymous.
Vulnerable:	Microsoft Windows XP Tablet PC Edition SP2 Microsoft Windows XP Tablet PC Edition SP1 Microsoft Windows XP Tablet PC Edition Microsoft Windows XP Professional SP2 Microsoft Windows XP Professional SP1 Microsoft Windows XP Professional Microsoft Windows XP Media Center Edition SP2 Microsoft Windows XP Media Center Edition SP1 Microsoft Windows XP Media Center Edition Microsoft Windows XP Home SP2 Microsoft Windows XP Home SP1 Microsoft Windows XP Home Microsoft Windows XP 64-bit Edition Version 2003 SP1 Microsoft Windows XP 64-bit Edition SP1 Microsoft Windows Server 2003 Web Edition Microsoft Windows Server 2003 Standard Edition Microsoft Windows Server 2003 Enterprise Edition Microsoft Windows Server 2003 Datacenter Edition Microsoft Windows ME Microsoft Windows 98SE Microsoft Windows 98 Microsoft Windows 2000 Server SP4 Microsoft Windows 2000 Server SP3 Microsoft Windows 2000 Server SP2 Microsoft Windows 2000 Server SP1 Microsoft Windows 2000 Server + Avaya DefinityOne Media Servers + Avaya IP600 Media Servers + Avaya S3400 Message Application Server 0 + Avaya S8100 Media Servers 0 Microsoft Windows 2000 Professional SP4 Microsoft Windows 2000 Professional SP3 Microsoft Windows 2000 Professional SP2 Microsoft Windows 2000 Professional SP1 Microsoft Windows 2000 Professional Microsoft Windows 2000 Datacenter Server SP4 Microsoft Windows 2000 Datacenter Server SP3 Microsoft Windows 2000 Datacenter Server SP2 Microsoft Windows 2000 Datacenter Server SP1 Microsoft Windows 2000 Datacenter Server Microsoft Windows 2000 Advanced Server SP4 Microsoft Windows 2000 Advanced Server SP3 Microsoft Windows 2000 Advanced Server SP2 Microsoft Windows 2000 Advanced Server SP1 Microsoft Windows 2000 Advanced Server

Not Vulnerable:

Discussion

Microsoft Windows Shell Remote Code Execution Vulnerability

Microsoft Windows is prone to a vulnerability that may allow remote attackers to execute code through the Windows Shell. The cause of the vulnerability is related to how the operating system handles unregistered file types. The specific issue is that files with an unknown extension may be opened with the application specified in the embedded CLSID.

The victim of the attack would be required to open a malicious file, possibly hosted on a Web site or sent through email. Social engineering would generally be required to entice the victim into opening the file.

Exploit / POC

Microsoft Windows Shell Remote Code Execution Vulnerability

There is no exploit required.

Proof of concept code has been released that will create a malicious document sufficient to exploit this vulnerability.

/data/vulnerabilities/exploits/ms05016.c
/data/vulnerabilities/exploits/windowsShellCodeExecPoC.cpp

Solution / Fix

Microsoft Windows Shell Remote Code Execution Vulnerability

Solution:
Microsoft has released fixes to address this vulnerability on supported platforms.

Microsoft Windows XP Media Center Edition SP2