Description
Argument injection vulnerability in the Windows Object Packager (packager.exe) in Microsoft Windows XP SP1 and SP2 and Server 2003 SP1 and earlier allows remote user-assisted attackers to execute arbitrary commands via a crafted file with a "/" (slash) character in the filename of the Command Line property, followed by a valid file extension, which causes the command before the slash to be executed, aka "Object Packager Dialogue Spoofing Vulnerability."
References
- 29424 vdb-entry
- SSRT061264 vendor-advisory
- VU#703936 third-party-advisory
- 20318 vdb-entry
- MS06-065 vendor-advisory
- ADV-2006-3984 vdb-entry
- http://secunia.com/secunia_research/2006-54/advisory/
- 20061014 Re: Secunia Research: Microsoft Windows Object Packager Dialog Spoofing mailing-list
- 20717 third-party-advisory
- oval:org.mitre.oval:def:496 vdb-entry signature
- 20061011 Secunia Research: Microsoft Windows Object Packager Dialog Spoofing mailing-list
- 1017037 vdb-entry