Check Point Advisories

Update Protection against Windows Explorer GUID Remote Code Execution Vulnerability (MS06-045)

Check Point Reference:	CPAI-2006-115
Date Published:	11 Oct 2006
Severity:	High
Last Updated:	Thursday 03 May, 2007
Source:	Microsoft Security Bulletin MS06-045
Industry Reference:	CVE-2006-3281 US-CERT VU#655100
Protection Provided by:
Who is Vulnerable?	Microsoft Windows 2000 SP4 Microsoft Windows XP SP1 Microsoft Windows XP SP2 Microsoft Windows XP Professional x64 Edition Microsoft Windows Server 2003 Microsoft Windows Server 2003 SP1 Microsoft Windows Server 2003 (Itanium) Microsoft Windows Server 2003 SP1 (Itanium) Microsoft Windows Server 2003 x64 Edition
Vulnerability Description	Microsoft Internet Explorer (IE) contains a remote code execution vulnerability. The application fails to properly handle directories with CLSID extensions. A remote attacker can exploit this vulnerability to execute arbitrary commands on an affected system.
Update/Patch Avaliable	Apply patches : Microsoft Security Bulletin MS06-045 Microsoft Security Bulletin MS06-042
Vulnerability Details	This vulnerability is due to the way that Microsoft Internet Explorer handles Drag and Drop Events. A remote attacker can exploit this flaw by convincing a user to enter a specially crafted web page or open a malicious e-mail message or HTML file. The attacker must trick the user into executing a malicious file containing the CLSID Key identifier for HTML Applications (HTA). Successful exploitation of the vulnerability may result in arbitrary code execution on the target system.