This message is in MIME format. The first part should be readable text,
while the remaining parts are likely unreadable without MIME-aware tools.

--8323329-437043848-1191580876=:5461
Content-Type: TEXT/PLAIN; CHARSET=iso-8859-15; FORMAT=flowed
Content-Transfer-Encoding: QUOTED-PRINTABLE
Content-ID: <alpine.DEB.0.82.0710051242411.5461@loki.ct.heise. de>

Hello,

the URI handling problem on Windows XP systems with IE 7 installed hits a=
=20
lot of applications, not only Firefox (and mIRC) -- namely Skype, Acrobat=
=20
Reader, Miranda, Netscape.

To recap: with the installation of IE 7 Microsoft=20
changes the handling of URLs that are passed to the operating system on=20
Windows XP. After this, URLs that contain an invalid "%" encoding can=20
launch abitrary programms. One example is:

mailto:test%../../../../windows/system32/calc.exe".cmd

that launches the calculator when activated in affected applications.=20
Firefox fixed this problem in 2.0.6. After being notified by heise=20
Security, Skype fixed the problem in 3.5.0.239.


Still vulnerable (as of 4th of October) are:

Adobe Acrobat Reader 8.1: If a user clicks on such a link
in a PDF, calc.exe is executed.

Miranda v0.7: If a user klicks on this link in a chat window, calc.exe is=
=20
executed

Netscape 7.1: mailto is handled by Netscape itself, but=20
similar telnet:-links start the calculator.

This list can propably be extended with little effort.


On a question to MSRC if Microsoft is planning to react on this, we=20
recieved the following response:

"After its thorough investigation, Microsoft has revealed that this is=20
not a vulnerability in a Microsoft product."=A0


For further information see:

http://www.heise-security.co.uk/news/96982

bye, ju


--=20
Juergen Schmidt editor-in-chief heise Security www.heisec.de
Heise Zeitschriften Verlag, Helstorferstr. 7, D-30625 Hannover
Tel. +49 511 5352 300 FAX +49 511 5352 417 EMail ju@heisec.de
GPG-Key: 0x38EA4970, 5D7B 476D 84D5 94FF E7C5 67BE F895 0A18 38EA 4970
--8323329-437043848-1191580876=:5461--