NVD

Id
56036  
Name
CVE-2007-3896  
Description
The URL handling in Shell32.dll in the Windows shell in Microsoft Windows XP and Server 2003, with Internet Explorer 7 installed, allows remote attackers to execute arbitrary programs via invalid "%" sequences in a mailto: or other URI handler, as demonstrated using mIRC, Outlook, Firefox, Adobe Reader, Skype, and other applications. NOTE: this issue might be related to other issues involving URL handlers in Windows systems, such as CVE-2007-3845. There also might be separate but closely related issues in the applications that are invoked by the handlers.  
Reject
 
CVSS Version
2  
CVSS Score
9.3  
Severity
High  
CVSS Base Score
9.3  
CVSS Impact Subscore
10  
CVSS Exploit Subscore
8.6  
CVSS Vector
(AV:N/AC:M/Au:N/C:C/I:C/A:C)  
Pub Date
2017-01-07  
Published
2007-10-10  
Modified Date
2011-03-07  
Seq
2007-3896  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
285296 56036 CVE-2007-3896 http://blogs.zdnet.com/security/?p=577  View
285297 56036 CVE-2007-3896 20071003 0day: mIRC pwns Windows  View
285298 56036 CVE-2007-3896 20071003 Re: 0day: mIRC pwns Windows  View
285299 56036 CVE-2007-3896 20071005 URI handling woes in Acrobat Reader, Netscape, Miranda, Skype  View
285300 56036 CVE-2007-3896 20071006 Re: URI handling woes in Acrobat Reader, Netscape, Miranda, Skype  View
285301 56036 CVE-2007-3896 20071009 Re: URI handling woes in Acrobat Reader, Netscape, Miranda, Skype  View
285302 56036 CVE-2007-3896 20071007 Re: [Full-disclosure] URI handling woes in Acrobat Reader, Netscape, Miranda, Skype  View
285303 56036 CVE-2007-3896 20071005 URI handling woes in Acrobat Reader, Netscape, Miranda, Skype  View
285304 56036 CVE-2007-3896 20071006 Re: URI handling woes in Acrobat Reader, Netscape, Miranda, Skype  View
285305 56036 CVE-2007-3896 20071006 Re: URI handling woes in Acrobat Reader, Netscape, Miranda, Skype  View
285306 56036 CVE-2007-3896 20071006 Re: URI handling woes in Acrobat Reader, Netscape, Miranda, Skype  View
285307 56036 CVE-2007-3896 20071007 Re: URI handling woes in Acrobat Reader, Netscape, Miranda, Skype  View
285308 56036 CVE-2007-3896 20071007 Re: URI handling woes in Acrobat Reader, Netscape, Miranda, Skype  View
285309 56036 CVE-2007-3896 oval:org.mitre.oval:def:4581  View
285310 56036 CVE-2007-3896 1018831  View
285311 56036 CVE-2007-3896 http://www.heise-security.co.uk/news/96982  View
285312 56036 CVE-2007-3896 VU#403150  View
285313 56036 CVE-2007-3896 943521  View
285314 56036 CVE-2007-3896 MS07-061  View
285315 56036 CVE-2007-3896 20071004 Re[2]: 0day: mIRC pwns Windows  View
285316 56036 CVE-2007-3896 20071004 Re: 0day: mIRC pwns Windows  View
285317 56036 CVE-2007-3896 20071005 RE: URI handling woes in Acrobat Reader, Netscape, Miranda, Skype  View
285318 56036 CVE-2007-3896 20071006 Re[2]: URI handling woes in Acrobat Reader, Netscape, Miranda, Skype  View
285319 56036 CVE-2007-3896 20071006 Re[2]: [Full-disclosure] URI handling woes in Acrobat Reader, Netscape, Miranda, Skype  View
285320 56036 CVE-2007-3896 20071006 Re[2]: [Full-disclosure] URI handling woes in Acrobat Reader, Netscape,Miranda, Skype  View
285321 56036 CVE-2007-3896 20071007 Re[2]: [Full-disclosure] URI handling woes in Acrobat Reader, Netscape, Miranda, Skype  View
285322 56036 CVE-2007-3896 20071007 Re: [Full-disclosure] URI handling woes in Acrobat Reader, Netscape,Miranda, Skype  View
285323 56036 CVE-2007-3896 20071008 Re: [Full-disclosure] URI handling woes in Acrobat Reader, Netscape,Miranda, Skype  View
285324 56036 CVE-2007-3896 20071009 RE: [Full-disclosure] URI handling woes in Acrobat Reader, Netscape, Miranda, Skype  View
285325 56036 CVE-2007-3896 20071007 Re: Re[2]: [Full-disclosure] URI handling woes in Acrobat Reader, Netscape,Miranda, Skype  View
285326 56036 CVE-2007-3896 20071008 Re: [Full-disclosure] URI handling woes in Acrobat Reader, Netscape, Miranda, Skype  View
285327 56036 CVE-2007-3896 20071011 M$ will fix URI?  View
285328 56036 CVE-2007-3896 20071014 Third-party patch for CVE-2007-3896 (Internet Explorer 7 invalid URI handling) available  View
285329 56036 CVE-2007-3896 20071017 Re: Third-party patch for CVE-2007-3896, UPDATE NOW  View
285330 56036 CVE-2007-3896 SSRT071498  View
285331 56036 CVE-2007-3896 25945  View
285332 56036 CVE-2007-3896 1018822  View
285333 56036 CVE-2007-3896 TA07-317A  View
285334 56036 CVE-2007-3896 http://xs-sniper.com/blog/remote-command-exec-firefox-2005/  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
52101 JVNDB-2007-000764 Internet Explorer 7 がインストールされている Windows 環境における任意のプログラムが実行される脆弱性 Internet Explorer 7 がインストールされている Windows XP の環境化において、URL の取り扱いに不備が存在するために、mailto: URI 中の「%」文字、もしくはその他の URI ハンドラによって、任意のプログラムを実行される脆弱性が存在します。 CVE-2007-3896 27251 CVE-2007-3896 56036 9.3 http://jvndb.jvn.jp/ja/contents/2007/JVNDB-2007-000764.html 2007-07-25 2007-11-29 View