Advisory Details

September 16th, 2016

Microsoft Windows .URL File Remote Code Execution Vulnerability

ZDI-16-506
ZDI-CAN-3570

CVE ID CVE-2016-3353
CVSS SCORE 6.8, (AV:N/AC:M/Au:N/C:P/I:P/A:P)
AFFECTED VENDORS Microsoft
AFFECTED PRODUCTS Windows
VULNERABILITY DETAILS


This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Microsoft Windows. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

An attacker can craft a malicious file with a .URL extension. If the victim opens the .URL file, the attacker can execute arbitrary code on the victim's machine under the context of the user.

VENDOR RESPONSE Microsoft has issued an update to correct this vulnerability. More details can be found at:
https://technet.microsoft.com/library/security/MS16-104
DISCLOSURE TIMELINE
  • 2016-02-08 - Vulnerability reported to vendor
  • 2016-09-16 - Coordinated public release of advisory
CREDIT Eduardo Braun Prado
BACK TO ADVISORIES