CVE-2004-0420 The Windows Shell application in Windows 98, Windows ME, Windows NT 4.0, Windows 2000, Windows XP, and Windows Server 2003 allows remote attackers to execute arbitrary code by spoofing the type of a f...
HighCVSS 10.0
EPSS 46.0%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The Windows Shell application in Windows 98, Windows ME, Windows NT 4.0, Windows 2000, Windows XP, and Windows Server 2003 allows remote attackers to execute arbitrary code by spoofing the type of a file via a CLSID specifier in the filename, as demonstrated using Internet Explorer 6.0.2800.1106 on Windows XP.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Microsoft ie | = 6.0-sp1 | No fix listed |
| Microsoft internet explorer | = 6.0 | No fix listed |
| Microsoft internet explorer | = 6.0.2800.1106 | No fix listed |
References
- 10736 third-party-advisory
- VU#106324 third-party-advisory us-government-resource
- 20040127 RE: GOOROO CROSSING: File Spoofing Internet Explorer 6 mailing-list
- 20040127 GOOROO CROSSING: File Spoofing Internet Explorer 6 exploit mailing-list vendor-advisory
- 9510 exploit vdb-entry vendor-advisory
- TA04-196A third-party-advisory us-government-resource
- MS04-024 vendor-advisory
- ie-clsid-file-extension-spoofing(14964) vdb-entry
- oval:org.mitre.oval:def:2245 signature vdb-entry
- oval:org.mitre.oval:def:2381 signature vdb-entry
- oval:org.mitre.oval:def:2894 signature vdb-entry
- oval:org.mitre.oval:def:3386 signature vdb-entry
- oval:org.mitre.oval:def:3533 signature vdb-entry
- oval:org.mitre.oval:def:3604 signature vdb-entry