TITLE: Microsoft Windows Shell and Web View Three Vulnerabilities SECUNIA ADVISORY ID: SA17168
VERIFY ADVISORY: http://secunia.com/advisories/17168/ CRITICAL: Moderately critical IMPACT: System access WHERE: >From remote OPERATING SYSTEM: Microsoft Windows XP Professional http://secunia.com/product/22/ Microsoft Windows XP Home Edition http://secunia.com/product/16/ Microsoft Windows Server 2003 Web Edition http://secunia.com/product/1176/ Microsoft Windows Server 2003 Standard Edition http://secunia.com/product/1173/ Microsoft Windows Server 2003 Enterprise Edition http://secunia.com/product/1174/ Microsoft Windows Server 2003 Datacenter Edition http://secunia.com/product/1175/ Microsoft Windows 2000 Server http://secunia.com/product/20/ Microsoft Windows 2000 Professional http://secunia.com/product/1/ Microsoft Windows 2000 Datacenter Server http://secunia.com/product/1177/ Microsoft Windows 2000 Advanced Server http://secunia.com/product/21/ DESCRIPTION: Three vulnerabilities has been reported in Microsoft Windows, allowing malicious people to compromise a users system. 1) The vulnerability is caused due an error in the handling of properties associated with ".lnk" files. This can be exploited to execute arbitrary code with the privileges of the user opening the ".lnk" file. 2) The vulnerability is caused due to an unchecked buffer in the handling of properties associated with a ".lnk" file. This can be exploited to execute arbitrary code with the privileges of the user viewing the properties of or opening the ".lnk" file. 3) The vulnerability is caused due to an error in the way Windows Explorer handles certain HTML characters in the preview field. This can be exploited to execute arbitrary code with the privileges of the user viewing the malicious file. SOLUTION: Apply patches. Microsoft Windows 2000 (requires Service Pack 4): http://www.microsoft.com/downloads/details.aspx?FamilyId=1F063C4A-B0BF-49C6-928B-F1F076C69612 Microsoft Windows XP (requires Service Pack 1 or Service Pack 2): http://www.microsoft.com/downloads/details.aspx?FamilyId=F7241DEB-9E2D-401A-9D71-10ACAB4450AF Microsoft Windows XP Professional x64 Edition: http://www.microsoft.com/downloads/details.aspx?FamilyId=594AD01B-F333-4C56-9C12-D1A8B82F2A6E Microsoft Windows Server 2003 (with or without Service Pack 1): http://www.microsoft.com/downloads/details.aspx?FamilyId=1A4FCFDE-E549-4078-A180-076A23CB8BB7 Microsoft Windows Server 2003 (Itanium) (with or without SP 1): http://www.microsoft.com/downloads/details.aspx?FamilyId=3BA63AF8-3D36-4F3C-BFEE-11B62572AF73 Microsoft Windows Server 2003 x64 Edition: http://www.microsoft.com/downloads/details.aspx?FamilyId=994B14B4-EE98-4B61-BDBE-CA5C20094855 ORIGINAL ADVISORY: MS05-049 (KB900725): http://www.microsoft.com/technet/security/Bulletin/MS05-049.mspx ============= PCWorks Mailing List ================= Don't see your post? Check our posting guidelines & make sure you've followed proper posting procedures, http://pcworkers.com/rules.htm Contact list owner <[EMAIL PROTECTED]> Unsubscribing and other changes: http://pcworkers.com =====================================================
