Signature Detail

HTTP: Microsoft Windows Shell File Name Code Execution

A vulnerability exists in Microsoft Windows Shell. The vulnerability is due to the way the Windows shell handles file and directory names. An attacker can exploit this vulnerability by enticing a user to open a file or directory with a specially crafted name. Successful exploitation could lead to arbitrary code execution in the security context of the target user.

Extended Description

Microsoft Windows is prone to a remote command-injection that affects the Windows Shell component vulnerability because it fails to adequately sanitize user-supplied input data. Attackers can exploit this issue to execute arbitrary shell commands with user-level privileges. This may facilitate the remote compromise of affected computers.

Affected Products

• Microsoft Windows 7
• Microsoft Windows 7 for 32-bit Systems SP1
• Microsoft Windows 7 for 32-bit Systems
• Microsoft Windows 7 for Itanium-based Systems SP1
• Microsoft Windows 7 for Itanium-based Systems
• Microsoft Windows 7 for x64-based Systems SP1
• Microsoft Windows 7 for x64-based Systems
• Microsoft Windows 7 Home Premium - Sp1 X32
• Microsoft Windows 7 Home Premium - Sp1 X64
• Microsoft Windows 7 Home Premium
• Microsoft Windows 7 Professional
• Microsoft Windows Server 2003
• Microsoft Windows Server 2008
• Microsoft Windows Server 2008 R2
• Microsoft Windows Server 2003 Gold
• Microsoft Windows Server 2003 Gold Compute Cluster
• Microsoft Windows Server 2003 Gold Datacenter
• Microsoft Windows Server 2003 Gold Enterprise
• Microsoft Windows Server 2003 Gold Itanium
• Microsoft Windows Server 2003 Gold Standard
• Microsoft Windows Server 2003 Gold Storage
• Microsoft Windows Server 2003 Gold X64
• Microsoft Windows Server 2003 Gold X64-Datacenter
• Microsoft Windows Server 2003 Gold X64-Enterprise
• Microsoft Windows Server 2003 Gold X64-Standard
• Microsoft Windows Server 2003 Datacenter Edition SP1
• Microsoft Windows Server 2003 Datacenter Edition SP1 Beta 1
• Microsoft Windows Server 2003 Datacenter Edition
• Microsoft Windows Server 2003 Datacenter Edition Itanium SP1
• Microsoft Windows Server 2003 Datacenter Edition Itanium SP1 Beta 1
• Microsoft Windows Server 2003 Datacenter Edition Itanium
• Microsoft Windows Server 2003 Datacenter x64 Edition SP2
• Microsoft Windows Server 2003 Datacenter x64 Edition
• Microsoft Windows Server 2003 Enterprise Edition SP1
• Microsoft Windows Server 2003 Enterprise Edition SP1 Beta 1
• Microsoft Windows Server 2003 Enterprise Edition
• Microsoft Windows Server 2003 Enterprise Edition Itanium SP1
• Microsoft Windows Server 2003 Enterprise Edition Itanium SP1 Beta 1
• Microsoft Windows Server 2003 Enterprise Edition Itanium SP2
• Microsoft Windows Server 2003 Enterprise Edition Itanium Sp2 Itanium
• Microsoft Windows Server 2003 Enterprise Edition Itanium
• Microsoft Windows Server 2003 Enterprise x64 Edition SP2
• Microsoft Windows Server 2003 Enterprise x64 Edition
• Microsoft Windows Server 2003 Itanium SP1
• Microsoft Windows Server 2003 Itanium SP2
• Microsoft Windows Server 2003 Itanium
• Microsoft Windows Server 2008 R2 SP1
• Microsoft Windows Server 2008 - Sp2 Enterprise X64
• Microsoft Windows Server 2008 Datacenter Edition Release Candidate
• Microsoft Windows Server 2008 Datacenter Edition SP2
• Microsoft Windows Server 2008 Datacenter Edition
• Microsoft Windows Server 2008 Enterprise Edition Release Candidate
• Microsoft Windows Server 2008 Enterprise Edition SP2
• Microsoft Windows Server 2008 Enterprise Edition
• Microsoft Windows Server 2008 for 32-bit Systems SP2
• Microsoft Windows Server 2008 for 32-bit Systems
• Microsoft Windows Server 2008 for Itanium-based Systems R2
• Microsoft Windows Server 2008 for Itanium-based Systems SP2
• Microsoft Windows Server 2008 for Itanium-based Systems
• Microsoft Windows Server 2008 for x64-based Systems R2
• Microsoft Windows Server 2008 for x64-based Systems SP2
• Microsoft Windows Server 2008 for x64-based Systems
• Microsoft Windows Server 2008 R2 Datacenter SP1
• Microsoft Windows Server 2008 R2 Datacenter
• Microsoft Windows Server 2008 R2 Enterprise Edition
• Microsoft Windows Server 2008 R2 for x64-based Systems SP1
• Microsoft Windows Server 2008 R2 for x64-based Systems
• Microsoft Windows Server 2008 R2 Itanium SP1
• Microsoft Windows Server 2008 R2 Itanium
• Microsoft Windows Server 2008 R2 Standard Edition
• Microsoft Windows Server 2008 R2 x64 SP1
• Microsoft Windows Server 2008 R2 x64
• Microsoft Windows Server 2008 Standard Edition - Gold
• Microsoft Windows Server 2008 Standard Edition - Gold Datacenter
• Microsoft Windows Server 2008 Standard Edition - Gold Enterprise
• Microsoft Windows Server 2008 Standard Edition - Gold Hpc
• Microsoft Windows Server 2008 Standard Edition - Gold Itanium
• Microsoft Windows Server 2008 Standard Edition - Gold Standard
• Microsoft Windows Server 2008 Standard Edition - Gold Storage
• Microsoft Windows Server 2008 Standard Edition - Gold Web
• Microsoft Windows Server 2008 Standard Edition Itanium
• Microsoft Windows Server 2008 Standard Edition R2
• Microsoft Windows Server 2008 Standard Edition R2 SP1
• Microsoft Windows Server 2008 Standard Edition Release Candidate
• Microsoft Windows Server 2008 Standard Edition SP2
• Microsoft Windows Server 2008 Standard Edition - Sp2 Hpc
• Microsoft Windows Server 2008 Standard Edition - Sp2 Storage
• Microsoft Windows Server 2008 Standard Edition - Sp2 Web
• Microsoft Windows Server 2008 Standard Edition X64
• Microsoft Windows Server 2008 Standard Edition
• Microsoft Windows Server 2008 Standard Edition
• Microsoft Windows Vista Business
• Microsoft Windows Vista Business SP1
• Microsoft Windows Vista Business SP2
• Microsoft Windows Vista Enterprise
• Microsoft Windows Vista Enterprise SP1
• Microsoft Windows Vista Enterprise SP2
• Microsoft Windows Vista Home Basic
• Microsoft Windows Vista Home Basic SP1
• Microsoft Windows Vista Home Basic SP2
• Microsoft Windows Vista Home Premium
• Microsoft Windows Vista Home Premium SP1
• Microsoft Windows Vista Home Premium SP2
• Microsoft Windows Vista SP1
• Microsoft Windows Vista SP2
• Microsoft Windows Vista SP2 Beta
• Microsoft Windows Vista Ultimate
• Microsoft Windows Vista Ultimate SP1
• Microsoft Windows Vista Ultimate SP2
• Microsoft Windows Vista
• Microsoft Windows Vista Business 64-bit edition SP1
• Microsoft Windows Vista Business 64-bit edition Sp1 X64-Enterprise
• Microsoft Windows Vista Business 64-bit edition Sp1 X64-Home Premium
• Microsoft Windows Vista Business 64-bit edition Sp1 X64-Ultimate
• Microsoft Windows Vista Business 64-bit edition Sp1 X86-Enterprise
• Microsoft Windows Vista Business 64-bit edition Sp1 X86-Ultimate
• Microsoft Windows Vista Business 64-bit edition SP2
• Microsoft Windows Vista Business 64-bit edition X64-Enterprise
• Microsoft Windows Vista Business 64-bit edition X64-Ultimate
• Microsoft Windows Vista Business 64-bit edition X86-Enterprise
• Microsoft Windows Vista Business 64-bit edition X86-Ultimate
• Microsoft Windows Vista Business 64-bit edition
• Microsoft Windows Vista Enterprise 64-bit edition SP1
• Microsoft Windows Vista Enterprise 64-bit edition SP2
• Microsoft Windows Vista Enterprise 64-bit edition
• Microsoft Windows Vista Home Basic 64-bit edition SP1
• Microsoft Windows Vista Home Basic 64-bit edition Sp1 X64
• Microsoft Windows Vista Home Basic 64-bit edition SP2
• Microsoft Windows Vista Home Basic 64-bit edition Sp2 X64
• Microsoft Windows Vista Home Basic 64-bit edition
• Microsoft Windows Vista Home Premium 64-bit edition SP1
• Microsoft Windows Vista Home Premium 64-bit edition SP2
• Microsoft Windows Vista Home Premium 64-bit edition
• Microsoft Windows Vista Service Pack 2
• Microsoft Windows Vista Ultimate 64-bit edition SP1
• Microsoft Windows Vista Ultimate 64-bit edition SP2
• Microsoft Windows Vista Ultimate 64-bit edition
• Microsoft Windows Vista x64 Edition SP1
• Microsoft Windows Vista x64 Edition SP2
• Microsoft Windows Vista x64 Edition
• Microsoft Windows XP
• Microsoft Windows XP 64-bit Edition SP1
• Microsoft Windows XP 64-bit Edition
• Microsoft Windows XP 64-bit Edition Version 2003 SP1
• Microsoft Windows XP 64-bit Edition Version 2003
• Microsoft Windows XP Embedded SP1
• Microsoft Windows XP Embedded SP2
• Microsoft Windows XP Embedded SP3
• Microsoft Windows XP Embedded
• Microsoft Windows XP Home SP1
• Microsoft Windows XP Home SP2
• Microsoft Windows XP Home SP3
• Microsoft Windows XP Home
• Microsoft Windows XP Media Center Edition SP1
• Microsoft Windows XP Media Center Edition SP2
• Microsoft Windows XP Media Center Edition SP3
• Microsoft Windows XP Media Center Edition
• Microsoft Windows XP Professional SP1
• Microsoft Windows XP Professional SP2
• Microsoft Windows XP Professional SP3
• Microsoft Windows XP Professional
• Microsoft Windows XP Professional x64 Edition SP2
• Microsoft Windows XP Professional x64 Edition SP3
• Microsoft Windows XP Professional x64 Edition
• Microsoft Windows XP Tablet PC Edition SP1
• Microsoft Windows XP Tablet PC Edition SP2
• Microsoft Windows XP Tablet PC Edition SP3
• Microsoft Windows XP Tablet PC Edition

References

• BugTraq: 54307
• CVE: CVE-2012-0175