National Cyber-Alert System

Vulnerability Summary for CVE-2005-0063

Overview

The document processing application used by the Windows Shell in Microsoft Windows 2000, Windows XP, and Windows Server 2003 allows remote attackers to execute arbitrary code by modifying the CLSID stored in a file so that it is processed by HTML Application Host (MSHTA), as demonstrated using a Microsoft Word document.

Impact

CVSS Severity (version 2.0):

CVSS Version 2 Metrics:

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

External Source: MS

Name: MS05-016

Type: Patch Information

Hyperlink:http://www.microsoft.com/technet/security/bulletin/ms05-016.mspx

External Source: IDEFENSE

Name: 20050412 Microsoft MSHTA Script Execution Vulnerability

Type: Patch Information

Hyperlink:http://www.idefense.com/application/poi/display?id=231&type=vulnerabilities

External Source: MISC

Name: http://www.securiteam.com/exploits/5YP0T0AFFW.html

Hyperlink:http://www.securiteam.com/exploits/5YP0T0AFFW.html

External Source: VUPEN

Name: ADV-2005-0335

Hyperlink:http://www.frsirt.com/english/advisories/2005/0335

External Source: BID

Name: 13132

Hyperlink:http://www.securityfocus.com/bid/13132

External Source: BUGTRAQ

Name: 20050529 Spam exploiting MS05-016

Hyperlink:http://marc.theaimsgroup.com/?l=bugtraq&m=111755356016155&w=2

US Government Resource: oval:org.mitre.oval:def:587

Name: oval:org.mitre.oval:def:587

Type: Tool Signature

Hyperlink:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:587

US Government Resource: oval:org.mitre.oval:def:573

Name: oval:org.mitre.oval:def:573

Type: Tool Signature

Hyperlink:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:573

US Government Resource: oval:org.mitre.oval:def:4710

Name: oval:org.mitre.oval:def:4710

Type: Tool Signature

Hyperlink:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:4710

US Government Resource: oval:org.mitre.oval:def:407

Name: oval:org.mitre.oval:def:407

Type: Tool Signature

Hyperlink:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:407

US Government Resource: oval:org.mitre.oval:def:3456

Name: oval:org.mitre.oval:def:3456

Type: Tool Signature

Hyperlink:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:3456

US Government Resource: oval:org.mitre.oval:def:2184

Name: oval:org.mitre.oval:def:2184

Type: Tool Signature

Hyperlink:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:2184