Vulnerability Description
Help and Support Center in Microsoft Windows XP SP1 does not properly validate HCP URLs, which allows remote attackers to execute arbitrary code via quotation marks in an hcp:// URL, which are not quoted when constructing the argument list to HelpCtr.exe.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Microsoft | Windows Server 2003 | - |
| Microsoft | Windows Xp | - |
Related Weaknesses (CWE)
References
- http://lists.grok.org.uk/pipermail/full-disclosure/2004-April/020065.htmlBroken Link
- http://marc.info/?l=bugtraq&m=108196864221676&w=2Third Party Advisory
- http://www.ciac.org/ciac/bulletins/o-114.shtmlBroken Link
- http://www.idefense.com/application/poi/display?id=100&type=vulnerabilitiesBroken Link
- http://www.kb.cert.org/vuls/id/260588PatchThird Party AdvisoryUS Government Resource
- http://www.securityfocus.com/bid/10119Broken LinkThird Party AdvisoryVDB Entry
- http://www.us-cert.gov/cas/techalerts/TA04-104A.htmlBroken LinkThird Party AdvisoryUS Government Resource
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2004/ms04-01PatchVendor Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/15704Third Party AdvisoryVDB Entry
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Broken Link
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Broken Link
- http://lists.grok.org.uk/pipermail/full-disclosure/2004-April/020065.htmlBroken Link
- http://marc.info/?l=bugtraq&m=108196864221676&w=2Third Party Advisory
- http://www.ciac.org/ciac/bulletins/o-114.shtmlBroken Link
- http://www.idefense.com/application/poi/display?id=100&type=vulnerabilitiesBroken Link
FAQ
What is CVE-2003-0907?
CVE-2003-0907 is a vulnerability with a CVSS score of 5.1 (MEDIUM). Help and Support Center in Microsoft Windows XP SP1 does not properly validate HCP URLs, which allows remote attackers to execute arbitrary code via quotation marks in an hcp:// URL, which are not quo...
How severe is CVE-2003-0907?
CVE-2003-0907 has been rated MEDIUM with a CVSS base score of 5.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2003-0907?
Check the references section above for vendor advisories and patch information. Affected products include: Microsoft Windows Server 2003, Microsoft Windows Xp.