Executive Summary
| Summary | |
|---|---|
| Title | Vulnerability in Windows URI Handling Could Allow Remote Code Execution (943460) |
| Informations | |||
|---|---|---|---|
| Name | MS07-061 | First vendor Publication | 2007-11-13 |
| Vendor | Microsoft | Last vendor Modification | 2007-11-13 |
| Severity (Vendor) | Critical | Revision | N/A |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:N/AC:M/Au:N/C:C/I:C/A:C) | |||
|---|---|---|---|
| Cvss Base Score | 9.3 | Attack Range | Network |
| Cvss Impact Score | 10 | Attack Complexity | Medium |
| Cvss Expoit Score | 8.6 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| This update resolves a publicly reported vulnerability. A remote code execution vulnerability exists in the way that the Windows shell handles specially crafted URIs that are passed to it. If the Windows shell did not sufficiently validate these URIs, an attacker could exploit this vulnerability and execute arbitrary code. Microsoft has only identified ways to exploit this vulnerability on systems using Internet Explorer 7. However, the vulnerability exists in a Windows file, Shell32.dll, which is included in all supported editions of Windows XP and Windows Server 2003. |
Original Source
| Url : http://www.microsoft.com/technet/security/bulletin/ms07-061.mspx |
CWE : Common Weakness Enumeration
| % | Id | Name |
|---|---|---|
| 100 % | CWE-20 | Improper Input Validation |
OVAL Definitions
| Definition Id: oval:org.mitre.oval:def:4581 | |||
| Oval ID: | oval:org.mitre.oval:def:4581 | ||
| Title: | Windows URI Handling Vulnerability | ||
| Description: | The URL handling in Shell32.dll in the Windows shell in Microsoft Windows XP and Server 2003, with Internet Explorer 7 installed, allows remote attackers to execute arbitrary programs via invalid "%" sequences in a mailto: or other URI handler, as demonstrated using mIRC, Outlook, Firefox, Adobe Reader, Skype, and other applications. NOTE: this issue might be related to other issues involving URL handlers in Windows systems, such as CVE-2007-3845. There also might be separate but closely related issues in the applications that are invoked by the handlers. | ||
| Family: | windows | Class: | vulnerability |
| Reference(s): | CVE-2007-3896 | Version: | 1 |
| Platform(s): | Microsoft Windows XP Microsoft Windows Server 2003 | Product(s): | |
| Definition Synopsis: | |||
| |||
CPE : Common Platform Enumeration
| Type | Description | Count |
|---|---|---|
| Application | 1 |
SAINT Exploits
| Description | Link |
|---|---|
| Windows IE7 URI Handler command execution through Firefox | More info here |
Open Source Vulnerability Database (OSVDB)
| Id | Description |
|---|---|
| 41090 | Microsoft Windows w/ IE7 Shell32.dll Crafted URL Third-party Application Arbi... |
Information Assurance Vulnerability Management (IAVM)
| Date | Description |
|---|---|
| 2007-11-15 | IAVM : 2007-A-0053 - Windows URI Handling Remote Code Execution Vulnerability Severity : Category II - VMSKEY : V0015397 |
Snort® IPS/IDS
| Date | Description |
|---|---|
| 2018-01-17 | Microsoft Windows ShellExecute and IE7 url handling code execution attempt RuleID : 45175 - Revision : 1 - Type : OS-WINDOWS |
| 2015-01-20 | Multiple product mailto uri handling code execution attempt RuleID : 32871 - Revision : 2 - Type : OS-WINDOWS |
| 2015-01-20 | Microsoft Windows ShellExecute and IE7 snews url handling code execution attempt RuleID : 32870 - Revision : 2 - Type : OS-WINDOWS |
| 2015-01-20 | Microsoft Windows ShellExecute and IE7 snews url handling code execution attempt RuleID : 32869 - Revision : 2 - Type : OS-WINDOWS |
| 2014-01-10 | Multiple product mailto uri handling code execution attempt RuleID : 18173 - Revision : 7 - Type : OS-WINDOWS |
| 2014-01-10 | Multiple product mailto uri handling code execution attempt RuleID : 18172 - Revision : 8 - Type : OS-WINDOWS |
| 2014-01-10 | Multiple product mailto uri handling code execution attempt RuleID : 18171 - Revision : 8 - Type : OS-WINDOWS |
| 2014-01-10 | Microsoft Windows ShellExecute and IE7 snews url handling code execution attempt RuleID : 17468 - Revision : 11 - Type : OS-WINDOWS |
| 2014-01-10 | Microsoft Windows ShellExecute and IE7 snews url handling code execution attempt RuleID : 17467 - Revision : 9 - Type : OS-WINDOWS |
| 2014-01-10 | Multiple product snews uri handling code execution attempt RuleID : 15684 - Revision : 10 - Type : OS-WINDOWS |
| 2014-01-10 | Multiple product mailto uri handling code execution attempt RuleID : 13272 - Revision : 12 - Type : OS-WINDOWS |
| 2014-01-10 | Multiple product telnet uri handling code execution attempt RuleID : 13271 - Revision : 12 - Type : OS-WINDOWS |
| 2014-01-10 | Multiple product news uri handling code execution attempt RuleID : 13270 - Revision : 12 - Type : OS-WINDOWS |
| 2014-01-10 | Multiple product nntp uri handling code execution attempt RuleID : 13269 - Revision : 12 - Type : OS-WINDOWS |
| 2014-01-10 | Microsoft Windows ShellExecute and IE7 url handling code execution attempt RuleID : 12688 - Revision : 16 - Type : OS-WINDOWS |
| 2014-01-10 | Microsoft Windows ShellExecute and IE7 url handling code execution attempt RuleID : 12687 - Revision : 12 - Type : OS-WINDOWS |
| 2014-01-10 | Microsoft Windows ShellExecute and Internet Explorer 7 url handling code exec... RuleID : 12664 - Revision : 9 - Type : BROWSER-IE |
| 2014-01-10 | Microsoft Windows URI External handler arbitrary command attempt RuleID : 12643 - Revision : 9 - Type : OS-WINDOWS |
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2007-11-13 | Name : Vulnerabilities in the Windows Shell may allow a user to elevate his privileges. File : smb_nt_ms07-061.nasl - Type : ACT_GATHER_INFO |
Alert History
| Date | Informations |
|---|---|
| 2014-02-17 11:45:48 |
|
| 2014-01-19 21:30:08 |
|
| 2013-11-11 12:41:06 |
|
| 2013-05-11 12:22:04 |
|
