A vulnerability has been identified in Microsoft Windows, which could be exploited by remote attackers to compromise a vulnerable system. This issue is caused due to the "ShellExecute" API function incorrectly validating data stream, which could be exploited by attackers to execute a binary from the local client system e.g. by tricking a user into visiting a specially crafted web page.

Affected Products

Microsoft Windows 2000 Service Pack 4
Microsoft Windows XP Service Pack 3
Microsoft Windows XP Service Pack 2
Microsoft Windows XP Professional x64 Edition Service Pack 2
Microsoft Windows Server 2003 x64 Edition Service Pack 2
Microsoft Windows Server 2003 SP2 (Itanium)
Microsoft Windows Server 2003 Service Pack 2

Solution

Apply patch for Microsoft Windows 2000 Service Pack 4:
http://www.microsoft.com/downloads/details.aspx?familyid=92234237-a8eb-4ce4-bc5e-cd86feb7dbd3

Apply patch for Microsoft Windows XP Service Pack 2 and Windows XP Service Pack 3:
http://www.microsoft.com/downloads/details.aspx?familyid=b8e7bf17-a037-4200-9ae2-2280b19766a4

Apply patch for Microsoft Windows XP Professional x64 Edition Service Pack 2:
http://www.microsoft.com/downloads/details.aspx?familyid=b8d83f30-9cd7-4d6b-b2b9-65d0a483cb9c

Apply patch for Microsoft Windows Server 2003 Service Pack 2:
http://www.microsoft.com/downloads/details.aspx?familyid=5cb2e203-18fb-4887-a1c9-289d86b8ba11

Apply patch for Microsoft Windows Server 2003 x64 Edition Service Pack 2:
http://www.microsoft.com/downloads/details.aspx?familyid=90360537-9311-45e2-8047-9a971f90c3c3

Apply patch for Microsoft Windows Server 2003 SP2 (Itanium):
http://www.microsoft.com/downloads/details.aspx?familyid=d695ca9f-a1db-4c0f-94b6-7112861c28da

References

http://www.vupen.com/english/advisories/2010/0340
http://www.microsoft.com/technet/security/bulletin/ms10-007.mspx

Credits

Vulnerability reported by Brett Moore via ZDI/TippingPoint and Lostmon Lords.

Changelog

2010-02-09 : Initial release

Feedback

If you have additional information or corrections for this security advisory please submit them via our contact form.