To me one this is of the nasties type of vulnerability...


Microsoft Security Bulletin MS11-006 - Critical
Vulnerability in Windows Shell Graphics Processing Could Allow Remote Code Execution (2483185)

simply a a "picture" in a web page is enough to gain remote access...

Historically this kind of vulnerability is too frequent for my "taste".

In the past, Microsoft still have the courage to post "mitigating factors" such:
Microsoft Security Bulletin MS06-026
Vulnerability in Graphics Rendering Engine Could Allow Remote Code Execution (918547)


<snip>

Mitigating Factors for Graphics Rendering Vulnerability - CVE-2006-2376:

• In a Web-based attack scenario, an attacker could host a Web site that contains a Web page that is used to exploit this vulnerability. Also, Web sites that accept or host user-provided content or advertisements, and compromised Web sites, may contain malicious content that could exploit this vulnerability. In all cases, however, an attacker would have no way to force users to visit these Web sites. Instead, an attacker would have to persuade users to visit the Web site, typically by getting them to click a link in an e-mail or Instant Messenger request that takes users to the attacker's Web site.

<snip>
 :( there are plenty a way to fool user accessing the malicious website...


Now at least they write more sensible mitigating factor:

<snip>
Mitigating Factors for Windows Shell Graphics Processing Overrun Vulnerability - CVE-2010-3970

Mitigation refers to a setting, common configuration, or general best-practice, existing in a default state, that could reduce the severity of exploitation of a vulnerability. The following mitigating factors may be helpful in your situation:

• The vulnerability cannot be exploited automatically through e-mail.
• An attacker who successfully exploited this vulnerability could gain the same user rights as the logged-on user. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.

<snip>

Labels: security