HTTP: Malicious OLE Object in Office Document

This signature detects attempts to exploit a known vulnerability against Windows Shell. Attackers can use this vulnerability to exploit a system if a user is logged on with administrative privileges. The attacker could take complete control of the affected system. However, user interaction is required to exploit this vulnerability.

Extended Description

Microsoft Windows is prone to a vulnerability that may allow remote attackers to execute code through the Windows Shell. The cause of the vulnerability is related to how the operating system handles unregistered file types. The specific issue is that files with an unknown extension may be opened with the application specified in the embedded CLSID. The victim of the attack would be required to open a malicious file, possibly hosted on a Web site or sent through email. Social engineering would generally be required to entice the victim into opening the file.

Affected Products

Microsoft windows_xp_media_center_edition

References

BugTraq: 13132

CVE: CVE-2005-0063

URL: http://www.kb.cert.org/vuls/id/673051

Short Name

HTTP:STC:OLE-SHELL

Severity

Major

Recommended

False

Recommended Action

Drop

HTTP: Malicious OLE Object in Office Document

Extended Description

Affected Products

References

Found a potential security threat?