Description
The Windows Shell application in Windows 98, Windows ME, Windows NT 4.0, Windows 2000, Windows XP, and Windows Server 2003 allows remote attackers to execute arbitrary code by spoofing the type of a file via a CLSID specifier in the filename, as demonstrated using Internet Explorer 6.0.2800.1106 on Windows XP.
References
- ie-clsid-file-extension-spoofing(14964) vdb-entry
- 9510 vdb-entry
- TA04-196A third-party-advisory
- 10736 third-party-advisory
- oval:org.mitre.oval:def:2894 vdb-entry signature
- oval:org.mitre.oval:def:3386 vdb-entry signature
- oval:org.mitre.oval:def:3604 vdb-entry signature
- oval:org.mitre.oval:def:2245 vdb-entry signature
- 20040127 GOOROO CROSSING: File Spoofing Internet Explorer 6 mailing-list
- oval:org.mitre.oval:def:3533 vdb-entry signature
- VU#106324 third-party-advisory
- 20040127 RE: GOOROO CROSSING: File Spoofing Internet Explorer 6 mailing-list
- oval:org.mitre.oval:def:2381 vdb-entry signature
- MS04-024 vendor-advisory