CVE-2007-3896: Input Validation

Published Oct 11, 2007

Updated

The URL handling in Shell32.dll in the Windows shell in Microsoft Windows XP and Server 2003, with Internet Explorer 7 installed, allows remote attackers to execute arbitrary programs via invalid "%" sequences in a mailto: or other URI handler, as demonstrated using mIRC, Outlook, Firefox, Adobe Reader, Skype, and other applications. NOTE: this issue might be related to other issues involving URL handlers in Windows systems, such as CVE-2007-3845. There also might be separate but closely related issues in the applications that are invoked by the handlers.

Affected Software

10 affected components

Microsoft Windows 2003 Server

Microsoft Windows 2003 Server=sp1

Microsoft Windows 2003 Server=sp2

Microsoft Windows XP

Microsoft Windows XP=sp2

Microsoft Internet Explorer=7.0

Event History

Oct 11, 2007

CVE Published

12:17 AM

Data Sourced

12:17 AM

DescriptionWeaknessAffected Software

CVE Published

via MITRE·04:00 AM

Data Sourced

via MITRE·04:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2007-3896?

CVE-2007-3896 is considered a critical vulnerability due to its ability to allow remote code execution.

How do I fix CVE-2007-3896?

To mitigate CVE-2007-3896, ensure that you apply the latest security patches provided by Microsoft.

What versions of Windows are affected by CVE-2007-3896?

CVE-2007-3896 affects Microsoft Windows XP and Windows Server 2003 with Internet Explorer 7 installed.

Can CVE-2007-3896 be exploited through email?

Yes, CVE-2007-3896 can be exploited via malicious mailto: links that utilize invalid '%' sequences.

What impact does CVE-2007-3896 have on affected systems?

CVE-2007-3896 can result in arbitrary code execution on the affected systems, posing a significant security risk.