HTTP: Desktop.ini Code Execution

This signature detects a Desktop.ini file transfer containing content that can be malicious. An attacker can plant a malicious WedDAV folder containing a Desktop.ini file, with a CLSID value that is associated with an executable file. If a user opens this folder, it can allow the attacker to execute remote code on the user's system.

Extended Description

Microsoft Windows Shell is prone to a remote code-execution vulnerability. This issue is due to a flaw in its handling of remote COM objects. Remote attackers may exploit this issue to execute arbitrary machine code in the context of the targeted user. This may facilitate the remote compromise of affected computers. This issue is described as a variant of the one in BID 10363 (Microsoft Windows XP Self-Executing Folder Vulnerability).

Affected Products

Microsoft windows_xp_media_center_edition

References

BugTraq: 17464

CVE: CVE-2006-0012

URL: http://www.microsoft.com/technet/security/bulletin/MS06-015.mspx

Short Name

HTTP:STC:DESKTOP-INI-CODE-EXE

Severity

Major

Recommended

False

Recommended Action

Drop

HTTP: Desktop.ini Code Execution

Extended Description

Affected Products

References

Found a potential security threat?