Rhino
02-08-2006, 03:11 PM
This is a WMF vulnerability, but for the older versions of Internet Explorer. 5.01 and 5.5. I suspect this is the same WMF vulnerability recently addressed for the newer IE versions, but Microsoft refused to address the older versions at that time. I can only assume they are now bowing to pressure from users of the older versions, except they aren't really addressing it now either, because the only solution they offer is to upgrade to IE6. The only real change here is that they previously classified the problem as non-critical for these early versions, and now they classify it as highly critical.
Secunia Advisory: SA18729
Release Date: 2006-02-08
Critical: Highly critical
Impact: System access
Where: From remote
Solution Status: Vendor Patch
Software: Microsoft Internet Explorer 5.01
Microsoft Internet Explorer 5.5
(snip)
Description: A vulnerability has been reported in Internet Explorer, which can be exploited by malicious people to compromise a user's system.
The vulnerability is caused due to an unspecified error. This can be exploited to execute arbitrary code on a user's system by e.g. tricking the user to visit a malicious website that hosts a specially crafted WMF file or via an email message containing a specially crafted attachment.
The vulnerability has been reported in the following versions:
* Internet Explorer 5.01 Service Pack 4 on Microsoft Windows 2000 Service Pack 4
* Internet Explorer 5.5 Service Pack 2 on Microsoft Windows Millennium.
The vulnerability does not affect the following versions of Windows:
* Windows XP Service Pack 1
* Windows XP Service Pack 2
* Windows XP Professional x64 Edition
* Windows Server 2003
* Windows Server 2003 Service Pack 1
* Windows Server 2003 for Itanium-based Systems
* Windows Server 2003 with Service Pack 1 for Itanium-based Systems
* Windows Server 2003 x64 Edition
NOTE: The vulnerability may also be exploitable through other applications handling WMF images.....http://secunia.com/advisories/18729/
Secunia Advisory: SA18729
Release Date: 2006-02-08
Critical: Highly critical
Impact: System access
Where: From remote
Solution Status: Vendor Patch
Software: Microsoft Internet Explorer 5.01
Microsoft Internet Explorer 5.5
(snip)
Description: A vulnerability has been reported in Internet Explorer, which can be exploited by malicious people to compromise a user's system.
The vulnerability is caused due to an unspecified error. This can be exploited to execute arbitrary code on a user's system by e.g. tricking the user to visit a malicious website that hosts a specially crafted WMF file or via an email message containing a specially crafted attachment.
The vulnerability has been reported in the following versions:
* Internet Explorer 5.01 Service Pack 4 on Microsoft Windows 2000 Service Pack 4
* Internet Explorer 5.5 Service Pack 2 on Microsoft Windows Millennium.
The vulnerability does not affect the following versions of Windows:
* Windows XP Service Pack 1
* Windows XP Service Pack 2
* Windows XP Professional x64 Edition
* Windows Server 2003
* Windows Server 2003 Service Pack 1
* Windows Server 2003 for Itanium-based Systems
* Windows Server 2003 with Service Pack 1 for Itanium-based Systems
* Windows Server 2003 x64 Edition
NOTE: The vulnerability may also be exploitable through other applications handling WMF images.....http://secunia.com/advisories/18729/