Vulnerability Note VU#403150
Microsoft Windows URI protocol handling vulnerability
Microsoft Windows fails to properly handle protocols specified in a URI, which could allow a remote, unauthenticated attacker to execute arbitrary commands on a vulnerable system.
A Uniform Resource Identifier (URI) is a string of characters that can be used to identify a location, resource, or protocol. Microsoft Windows will parse a URI to determine the appropriate application that is registered to handle the protocol. More information about how Windows accomplishes this is available in Microsoft Knowledge Base article 224816. Several types of Windows applications, such as web browsers and email clients, may rely on Microsoft Windows to determine the proper application to handle a specified URI.
Internet Explorer 7 has changed how Microsoft Windows parses URIs. This has introduced a flaw that can cause Windows to incorrectly determine the appropriate handler for the protocol specified in a URI. This flaw appears to rely on having a "%" character in the URI.
Microsoft Windows may incorrectly determine the appropriate application to handle a protocol. For example, a "safe" protocol such as mailto: may be incorrectly handled with an "unsafe" application, such as the Windows command interpreter. This can allow unexpected execution of arbitrary commands.
Apply an update
Systems Affected (Learn More)
|Vendor||Status||Date Notified||Date Updated|
|Adobe||Affected||-||11 Oct 2007|
|Microsoft Corporation||Affected||26 Jul 2007||13 Nov 2007|
|Mozilla||Affected||-||11 Oct 2007|
CVSS Metrics (Learn More)
This vulnerability was publicly disclosed by Billy Rios.
This document was written by Will Dormann.
- CVE IDs: CVE-2007-3896
- Date Public: 25 Jul 2007
- Date First Published: 27 Jul 2007
- Date Last Updated: 13 Nov 2007
- Severity Metric: 18.43
- Document Revision: 25
If you have feedback, comments, or additional information about this vulnerability, please send us email.