said by AB :

Thanks, Melissa!

said by the bulletin :

. . Vulnerability in Windows URI Handling Could Allow Remote Code Execution (943460)
»www.microsoft.com/technet/securi···061.mspx

From the link:

"Mitigating Factors for Windows URI Handling Vulnerability - CVE-2007-3896

•Windows 2000 Service Pack 4 is not affected

•Windows Vista is not affected

•Windows Vista x64 Edition is not affected

•Microsoft has not identified a way to exploit this vulnerability on any Windows operating system that is running Internet Explorer 6"

Uhh . . yeah. Sounds pretty scary, all right-- not.
Exactly who is affected? ME users running IE 4 & 5?

*Edit- On second blush, it might appear that IE 7 on Windows XP is vulnerable.

"Workarounds for Windows URI Handling Vulnerability - CVE-2007-3896

Microsoft has not identified any workarounds for this vulnerability."

Actually, it would seem you just did identify the 'workaround' there, Microsoft Corp.

quote:

---

Exposure:

Microsoft's two security bulletins detail vulnerabilities found in components of Windows. Each vulnerability affects different versions of Windows to a different extent. The summary below lists the sole Critical vulnerability first.

MS07-061: URI Handling Code Execution Vulnerability

Uniform Resource Identifiers (URI) are short strings of characters used to identify or name resources on networks, including the Internet. For instance, a URL such as »www.watchguard.com is actually one form of a URI, telling you where to find WatchGuard's web site. Besides identifying and addressing resources on a network, URIs also tell your computer how to handle those resources. For instance, the "http://" portion of "http://www.watchguard.com" tells your computer it needs to use a web browser to handle the resource "www.watchguard.com." Likewise, a URI beginning with "ftp://" informs your computer that it needs to use a File Transfer Protocol client to handle any following resource.

Windows' shell suffers from an unspecified vulnerability in the way it handles invalid URIs. By enticing one of your users into opening an email attachment, or into visiting a maliciously crafted web site, an attacker could exploit this vulnerability to execute code on that user's computer, with that user's privileges. If the victim Windows user has local administrative privileges, an attacker could leverage this vulnerability to take over the victim's machine. This vulnerability affects Windows XP and Server 2003 only.
Microsoft rating: Critical.

---