CVE-2005-0063 The document processing application used by the Windows Shell in Microsoft Windows 2000, Windows XP, and Windows Server 2003 allows remote attackers to execute arbitrary code by modifying the CLSID st...
HighCVSS 7.5
EPSS 47.6%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
The document processing application used by the Windows Shell in Microsoft Windows 2000, Windows XP, and Windows Server 2003 allows remote attackers to execute arbitrary code by modifying the CLSID stored in a file so that it is processed by HTML Application Host (MSHTA), as demonstrated using a Microsoft Word document.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Microsoft windows 2000 | All versions | No fix listed |
| Microsoft windows 2003 server | = enterprise | No fix listed |
| Microsoft windows 2003 server | = r2 | No fix listed |
| Microsoft windows 2003 server | = standard | No fix listed |
| Microsoft windows 2003 server | = web | No fix listed |
| Microsoft windows 98 | All versions | No fix listed |
| Microsoft windows 98se | All versions | No fix listed |
| Microsoft windows me | All versions | No fix listed |
| Microsoft windows xp | All versions | No fix listed |
References
- 20050529 Spam exploiting MS05-016 mailing-list
- 20050412 Microsoft MSHTA Script Execution Vulnerability patch third-party-advisory
- www.securiteam.com
- 13132 vdb-entry
- ADV-2005-0335 vdb-entry
- MS05-016 vendor-advisory
- oval:org.mitre.oval:def:2184 signature vdb-entry
- oval:org.mitre.oval:def:3456 signature vdb-entry
- oval:org.mitre.oval:def:407 signature vdb-entry
- oval:org.mitre.oval:def:4710 signature vdb-entry
- oval:org.mitre.oval:def:573 signature vdb-entry
- oval:org.mitre.oval:def:587 signature vdb-entry