CVE-2005-2117

Vulnerability

Web View in Windows Explorer on Microsoft Windows 2000 SP4, Windows XP SP1 and SP2, and Windows Server 2003 (including SP1 and x64 editions) does not properly handle certain HTML characters in preview fields [1]. This remote code execution vulnerability, documented in MS05-049, can be triggered when a user visits a malicious web page or opens a specially crafted file that leverages the Web View functionality [1]. The preview pane in Explorer interprets crafted HTML content in a way that allows arbitrary code execution [1].

Exploitation

Exploitation requires user interaction, such as visiting a malicious website or opening a file that triggers Web View [1]. The attacker does not need authentication but must convince the user to perform an action that renders the crafted HTML in Windows Explorer's preview pane [1]. The vulnerability is remotely exploitable, but the attack vector is user-assisted [1].

Impact

Successful exploitation of this vulnerability allows an attacker to execute arbitrary code in the context of the logged-on user [1]. If the user has administrative privileges, the attacker could gain complete control of the affected system, install programs, view or modify data, and create new accounts with full rights [1]. The impact is remote code execution with the potential for full system compromise [1].

Mitigation

Microsoft released security update MS05-049 in October 2005 to address this vulnerability [1]. The update is available for all affected systems: Windows 2000 SP4, Windows XP SP1/SP2, Windows XP Professional x64 Edition, Windows Server 2003, and Windows Server 2003 for Itanium-based systems [1]. No workarounds are documented in the bulletin; applying the update is the recommended mitigation [1].