Microsoft Windows Shell Arbitrary Code Execution Vulnerabilty

Reported July 13, 2004, byMicrosoft

VERSIONS AFFECTED

DESCRIPTION
A vulnerability in Windows could allow remote execution of arbitrary code onthe vulnerable system. This vulnerability is a result of a flaw in the way thatWindows Shell launches applications. A potential attacker could exploit thevulnerability if a user visited a malicious Web site. If the user is logged onwith administrative privileges, the attacker could take complete control of anaffected system. User interaction is required to exploit this vulnerability.

VENDOR RESPONSE
Microsoft has releasedbulletin MS04-024, "Vulnerability in Windows Shell Could AllowRemote Code Execution (839645)," to address this vulnerability andrecommends that affected users apply the appropriate patch listed in thebulletin.

CREDIT
Discovered by Microsoft.