Description
Windows Mail in Microsoft Windows Vista might allow user-assisted remote attackers to execute certain programs via a link to a (1) local file or (2) UNC share pathname in which there is a directory with the same base name as an executable program at the same level, as demonstrated using C:/windows/system32/winrm (winrm.cmd) and migwiz (migwiz.exe).
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 1
- Microsoft Windows Vista - Windows Mail Local File Execution EDB-29771 · remote · Mar 23, 2007 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- 20070323 Re: Microsoft Windows Vista - Windows Mail Client Side Code Execution Vulnerability mailing-list
- 20070323 Microsoft Windows Vista - Windows Mail Client Side Code Execution Vulnerability mailing-list
- MS07-034 vendor-advisory
- oval:org.mitre.oval:def:1861 vdb-entry signature
- http://news.com.com/2100-1002_3-6170133.html
- SSRT071438 vendor-advisory
- win-mail-code-execution(33167) vdb-entry
- http://www.computerworld.com/action/article.do?command=viewArticleBasic&articleId=9014194
- 1017816 vdb-entry
- 23103 vdb-entry
- 20070323 Re: Microsoft Windows Vista - Windows Mail Client Side Code Execution Vulnerability mailing-list
- TA07-163A third-party-advisory
- 25639 third-party-advisory
- ADV-2007-2154 vdb-entry
- http://isc.sans.org/diary.html?storyid=2507