PT-2004-1559 · Microsoft · Windows 98+7

Published 2004-04-20 · Updated 2021-07-23 · CVE-2004-0420

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Windows Shell versions in Windows 98, Windows ME, Windows NT 4.0, Windows 2000, Windows XP, and Windows Server 2003

Description The issue allows remote attackers to execute arbitrary code by spoofing the type of a file via a CLSID specifier in the filename. This can be demonstrated using Internet Explorer 6.0.2800.1106 on Windows XP.

Recommendations For Windows 98, Windows ME, Windows NT 4.0, Windows 2000, Windows XP, and Windows Server 2003, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2004-0420

Affected Products

Internet Explorer

Windows 2000

Windows 98

Windows Me

Windows Nt 4.0

Windows Server 2003

Windows Shell

Windows Xp

References · 15

• 🔥 http://securityfocus.com/bid/9510 · Exploit
• 🔥 http://securityfocus.com/archive/1/351379 · Exploit
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2004/ms04-024 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2004-0420 · Security Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A2894 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A2381 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A3533 · Note
• http://security-express.com/archives/bugtraq/2004-01/0300.html · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A3386 · Note
• http://us-cert.gov/cas/techalerts/TA04-196A.html · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A3604 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/14964 · Note
• http://secunia.com/advisories/10736 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A2245 · Note
• http://kb.cert.org/vuls/id/106324 · Note