Internet Explorer FTP malformed file name...

Date Discovered: December 30, 2004
Date Published: January 29, 2005
Last Updated: January 29, 2005

Vulnerability ID: 32173
Discovered by: Albert Puigsech Galicia
Exploitable Locally: No
Exploitable Remotely: Yes
Impact: Remote attackers can gain authorized system access.
Root Cause: Software Vulnerability

Microsoft Internet Explorer contains a vulnerability that can allow an attacker to gain unauthorized system access. The vulnerability is due to improper handling of FTP files containing certain characters. Attackers can create a carefully crafted file which could replace system files using directory traversal attacks when downloaded.

Recommendations

Technical Recommendation - 32173
The issue is fixed by Windows XP SP2.

Windows 2000 users should contact Microsoft Product Support Services to recieve the hotfix. Request the hotfix for Article ID : 810790.

http://support.microsoft.com/oas/default.aspx?ln=en-us&prid=8438&gprid=35540

Affected Technologies

Microsoft: Internet Explorer 6 SP1

References

Mitre CVE: CAN-2004-1376

Source : Computer Associates International
www.ca.com