CVE-2004-2289 Microsoft Windows XP Explorer allows local users to execute arbitrary code via a system folder with a Desktop.ini file containing a .ShellClassInfo specifier with a CLSID value that is associated with...
HighCVSS 10.0
EPSS 23.7%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Microsoft Windows XP Explorer allows local users to execute arbitrary code via a system folder with a Desktop.ini file containing a .ShellClassInfo specifier with a CLSID value that is associated with an executable file.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Microsoft windows xp | All versions | No fix listed |
References
- 20040517 Desktop.ini flaw results in executing folders exploit mailing-list vendor-advisory
- 11633 third-party-advisory vendor-advisory
- www.freewebs.com exploit
- 6221 exploit vdb-entry
- 10363 vdb-entry
- MS06-015 vendor-advisory
- winxp-explorer-code-execution(16171) vdb-entry