CVE-2007-3896
- State
- Published
- Severity
- Not scored
- Published
- Oct 11, 2007
- Updated
- Aug 7, 2024
- Reserved
- Jul 19, 2007
Description
The URL handling in Shell32.dll in the Windows shell in Microsoft Windows XP and Server 2003, with Internet Explorer 7 installed, allows remote attackers to execute arbitrary programs via invalid "%" sequences in a mailto: or other URI handler, as demonstrated using mIRC, Outlook, Firefox, Adobe Reader, Skype, and other applications. NOTE: this issue might be related to other issues involving URL handlers in Windows systems, such as CVE-2007-3845. There also might be separate but closely related issues in the applications that are invoked by the handlers.
Scores
The record has no CVSS score.
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
n/an/a |
|
References
- 20071017 Re: Third-party patch for CVE-2007-3896, UPDATE NOWmailing-list
- 20071005 URI handling woes in Acrobat Reader, Netscape, Miranda, Skypemailing-list
- 20071009 RE: [Full-disclosure] URI handling woes in Acrobat Reader, Netscape, Miranda, Skypemailing-list
- http://www.heise-security.co.uk/news/96982
- 20071006 Re[2]: [Full-disclosure] URI handling woes in Acrobat Reader, Netscape,Miranda, Skypemailing-list
- 20071006 Re[2]: URI handling woes in Acrobat Reader, Netscape, Miranda, Skypemailing-list
- 20071005 URI handling woes in Acrobat Reader, Netscape, Miranda, Skypemailing-list
- http://blogs.zdnet.com/security/?p=577
- 20071008 Re: [Full-disclosure] URI handling woes in Acrobat Reader, Netscape,Miranda, Skypemailing-list
- HPSBST02291vendor-advisory
- 26201third-party-advisory
- 20071006 Re: URI handling woes in Acrobat Reader, Netscape, Miranda, Skypemailing-list
- 20071006 Re: URI handling woes in Acrobat Reader, Netscape, Miranda, Skypemailing-list
- oval:org.mitre.oval:def:4581vdb-entrysignature
- http://xs-sniper.com/blog/remote-command-exec-firefox-2005/
- 20071007 Re: URI handling woes in Acrobat Reader, Netscape, Miranda, Skypemailing-list
- 20071007 Re: [Full-disclosure] URI handling woes in Acrobat Reader, Netscape,Miranda, Skypemailing-list
- 1018831vdb-entry
- 20071009 Re: URI handling woes in Acrobat Reader, Netscape, Miranda, Skypemailing-list
- 20071006 Re: URI handling woes in Acrobat Reader, Netscape, Miranda, Skypemailing-list
- 20071007 Re: Re[2]: [Full-disclosure] URI handling woes in Acrobat Reader, Netscape,Miranda, Skypemailing-list
- 20071006 Re[2]: [Full-disclosure] URI handling woes in Acrobat Reader, Netscape, Miranda, Skypemailing-list
- 20071007 Re[2]: [Full-disclosure] URI handling woes in Acrobat Reader, Netscape, Miranda, Skypemailing-list
- TA07-317Athird-party-advisory
- 20071007 Re: URI handling woes in Acrobat Reader, Netscape, Miranda, Skypemailing-list
- 943521vendor-advisory
- 20071004 Re[2]: 0day: mIRC pwns Windowsmailing-list
- 20071005 RE: URI handling woes in Acrobat Reader, Netscape, Miranda, Skypemailing-list
- MS07-061vendor-advisory
- 25945vdb-entry
- 20071008 Re: [Full-disclosure] URI handling woes in Acrobat Reader, Netscape, Miranda, Skypemailing-list
- 20071014 Third-party patch for CVE-2007-3896 (Internet Explorer 7 invalid URI handling) availablemailing-list
- VU#403150third-party-advisory
- 20071011 M$ will fix URI?mailing-list
- 20071003 0day: mIRC pwns Windowsmailing-list
- 20071004 Re: 0day: mIRC pwns Windowsmailing-list
- 20071007 Re: [Full-disclosure] URI handling woes in Acrobat Reader, Netscape, Miranda, Skypemailing-list
- 20071006 Re: URI handling woes in Acrobat Reader, Netscape, Miranda, Skypemailing-list
- 20071003 Re: 0day: mIRC pwns Windowsmailing-list
- 1018822vdb-entry
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.