Microsoft Windows XP Explorer Self-Executing Folder Vulnerability
BID:9487
Info
Microsoft Windows XP Explorer Self-Executing Folder Vulnerability
| Bugtraq ID: | 9487 |
| Class: | Unknown |
| CVE: | |
| Remote: | Yes |
| Local: | Yes |
| Published: | Jan 26 2004 12:00AM |
| Updated: | Jan 26 2004 12:00AM |
| Credit: | Discovery of this issue is credited to "[email protected]" <[email protected]>. |
| Vulnerable: |
Microsoft Windows XP Professional SP1 Microsoft Windows XP Professional Microsoft Windows XP Home SP1 Microsoft Windows XP Home |
| Not Vulnerable: | |
Discussion
Microsoft Windows XP Explorer Self-Executing Folder Vulnerability
A vulnerability has been reported in Microsoft Windows XP that may result in execution of malicious code in the context of the currently logged in user. The flaw exists in Windows Explorer and may allow for executable content that is referenced from inside of a folder to be executed automatically when the folder is accessed.
This vulnerability poses a security risk since it is assumed that opening a folder is a safe action and that executable content cannot be run when a folder is accessed. Additionally, it has been reported that this issue may be exploitable remotely if the malicious folder is accessed from an SMB share.
A vulnerability has been reported in Microsoft Windows XP that may result in execution of malicious code in the context of the currently logged in user. The flaw exists in Windows Explorer and may allow for executable content that is referenced from inside of a folder to be executed automatically when the folder is accessed.
This vulnerability poses a security risk since it is assumed that opening a folder is a safe action and that executable content cannot be run when a folder is accessed. Additionally, it has been reported that this issue may be exploitable remotely if the malicious folder is accessed from an SMB share.
Exploit / POC
Microsoft Windows XP Explorer Self-Executing Folder Vulnerability
An exploit example is available at the following location:
http://www.malware.com/my.pics.zip
An exploit example is available at the following location:
http://www.malware.com/my.pics.zip
Solution / Fix
Microsoft Windows XP Explorer Self-Executing Folder Vulnerability
Solution:
It is reported that this issue is allegedly addressed by Microsoft Security Bulletin MS04-011. This information is not confirmed at the moment. Please contact Microsoft for more information.
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
It is reported that this issue is allegedly addressed by Microsoft Security Bulletin MS04-011. This information is not confirmed at the moment. Please contact Microsoft for more information.
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
References
Microsoft Windows XP Explorer Self-Executing Folder Vulnerability
References:
References: