« Volver al listado

CVE-2007-3896

Estado: ModificadaAlta (9.3)—💥 Exploit

El manejo de URL en la biblioteca Shell32.dll en el shell de Windows en Microsoft Windows XP y Server 2003, con Internet Explorer versión 7 instalado, permite a atacantes remotos ejecutar programas arbitrarios por medio de secuencias "%" no válidas en un mailto: u otro manejador URI, como es demostrado usando mIRC, Outlook, Firefox, Adobe Reader, Skype y otras aplicaciones. NOTA: este problema podría estar relacionado con otros problemas relacionados con los controladores de URL en sistemas Windows, tal y como CVE-2007-3845. También puede haber problemas separados pero estrechamente relacionados en las aplicaciones que son invocadas por los manejadores.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

💥 Exploits públicos

Hay código de explotación o plantillas de detección públicos. No es lo mismo que explotación activa confirmada (KEV), pero aumenta el riesgo: parchee con prioridad.

Tecnologías afectadas (1)

Microsoft — Internet Explorer

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2007-3896",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 9.3,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
          "authentication": "NONE",
          "integrityImpact": "COMPLETE",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "COMPLETE"
        },
        "acInsufInfo": false,
        "impactScore": 10,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ]
  },
  "affected": [
    {
      "source": "secure@microsoft.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2007-10-11T00:17:00.000",
  "references": [
    {
      "url": "http://blogs.zdnet.com/security/?p=577",
      "source": "secure@microsoft.com"
    },
    {
      "url": "http://marc.info/?l=bugtraq&m=119143780202107&w=2",
      "source": "secure@microsoft.com"
    },
    {
      "url": "http://marc.info/?l=bugtraq&m=119144449915918&w=2",
      "source": "secure@microsoft.com"
    },
    {
      "url": "http://marc.info/?l=bugtraq&m=119159924712561&w=2",
      "source": "secure@microsoft.com"
    },
    {
      "url": "http://marc.info/?l=bugtraq&m=119168062128026&w=2",
      "source": "secure@microsoft.com"
    },
    {
      "url": "http://marc.info/?l=bugtraq&m=119194714125580&w=2",
      "source": "secure@microsoft.com"
    },
    {
      "url": "http://marc.info/?l=bugtraq&m=119195904813505&w=2",
      "source": "secure@microsoft.com"
    },
    {
      "url": "http://marc.info/?l=full-disclosure&m=119159477404263&w=2",
      "source": "secure@microsoft.com"
    },
    {
      "url": "http://marc.info/?l=full-disclosure&m=119168727402084&w=2",
      "source": "secure@microsoft.com"
    },
    {
      "url": "http://marc.info/?l=full-disclosure&m=119170531020020&w=2",
      "source": "secure@microsoft.com"
    },
    {
      "url": "http://marc.info/?l=full-disclosure&m=119171444628628&w=2",
      "source": "secure@microsoft.com"
    },
    {
      "url": "http://marc.info/?l=full-disclosure&m=119175323322021&w=2",
      "source": "secure@microsoft.com"
    },
    {
      "url": "http://marc.info/?l=full-disclosure&m=119180333805950&w=2",
      "source": "secure@microsoft.com"
    },
    {
      "url": "http://secunia.com/advisories/26201",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "secure@microsoft.com"
    },
    {
      "url": "http://securitytracker.com/id?1018831",
      "source": "secure@microsoft.com"
    },
    {
      "url": "http://www.heise-security.co.uk/news/96982",
      "source": "secure@microsoft.com"
    },
    {
      "url": "http://www.kb.cert.org/vuls/id/403150",
      "tags": [
        "US Government Resource"
      ],
      "source": "secure@microsoft.com"
    },
    {
      "url": "http://www.microsoft.com/technet/security/advisory/943521.mspx",
      "source": "secure@microsoft.com"
    },
    {
      "url": "http://www.securityfocus.com/archive/1/481493/100/100/threaded",
      "source": "secure@microsoft.com"
    },
    {
      "url": "http://www.securityfocus.com/archive/1/481505/100/0/threaded",
      "source": "secure@microsoft.com"
    },
    {
      "url": "http://www.securityfocus.com/archive/1/481624/100/0/threaded",
      "source": "secure@microsoft.com"
    },
    {
      "url": "http://www.securityfocus.com/archive/1/481664/100/0/threaded",
      "source": "secure@microsoft.com"
    },
    {
      "url": "http://www.securityfocus.com/archive/1/481671/100/0/threaded",
      "source": "secure@microsoft.com"
    },
    {
      "url": "http://www.securityfocus.com/archive/1/481680/100/0/threaded",
      "source": "secure@microsoft.com"
    },
    {
      "url": "http://www.securityfocus.com/archive/1/481839/100/0/threaded",
      "source": "secure@microsoft.com"
    },
    {
      "url": "http://www.securityfocus.com/archive/1/481846/100/0/threaded",
      "source": "secure@microsoft.com"
    },
    {
      "url": "http://www.securityfocus.com/archive/1/481867/100/0/threaded",
      "source": "secure@microsoft.com"
    },
    {
      "url": "http://www.securityfocus.com/archive/1/481871/100/0/threaded",
      "source": "secure@microsoft.com"
    },
    {
      "url": "http://www.securityfocus.com/archive/1/481881/100/0/threaded",
      "source": "secure@microsoft.com"
    },
    {
      "url": "http://www.securityfocus.com/archive/1/481887/100/0/threaded",
      "source": "secure@microsoft.com"
    },
    {
      "url": "http://www.securityfocus.com/archive/1/482090/100/0/threaded",
      "source": "secure@microsoft.com"
    },
    {
      "url": "http://www.securityfocus.com/archive/1/482292/100/0/threaded",
      "source": "secure@microsoft.com"
    },
    {
      "url": "http://www.securityfocus.com/archive/1/482437/100/0/threaded",
      "source": "secure@microsoft.com"
    },
    {
      "url": "http://www.securityfocus.com/archive/1/484186/100/0/threaded",
      "source": "secure@microsoft.com"
    },
    {
      "url": "http://www.securityfocus.com/bid/25945",
      "source": "secure@microsoft.com"
    },
    {
      "url": "http://www.securitytracker.com/id?1018822",
      "source": "secure@microsoft.com"
    },
    {
      "url": "http://www.us-cert.gov/cas/techalerts/TA07-317A.html",
      "tags": [
        "US Government Resource"
      ],
      "source": "secure@microsoft.com"
    },
    {
      "url": "http://xs-sniper.com/blog/remote-command-exec-firefox-2005/",
      "source": "secure@microsoft.com"
    },
    {
      "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2007/ms07-061",
      "source": "secure@microsoft.com"
    },
    {
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A4581",
      "source": "secure@microsoft.com"
    },
    {
      "url": "http://blogs.zdnet.com/security/?p=577",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://marc.info/?l=bugtraq&m=119143780202107&w=2",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://marc.info/?l=bugtraq&m=119144449915918&w=2",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://marc.info/?l=bugtraq&m=119159924712561&w=2",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://marc.info/?l=bugtraq&m=119168062128026&w=2",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://marc.info/?l=bugtraq&m=119194714125580&w=2",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://marc.info/?l=bugtraq&m=119195904813505&w=2",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://marc.info/?l=full-disclosure&m=119159477404263&w=2",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://marc.info/?l=full-disclosure&m=119168727402084&w=2",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://marc.info/?l=full-disclosure&m=119170531020020&w=2",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://marc.info/?l=full-disclosure&m=119171444628628&w=2",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://marc.info/?l=full-disclosure&m=119175323322021&w=2",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://marc.info/?l=full-disclosure&m=119180333805950&w=2",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/26201",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://securitytracker.com/id?1018831",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.heise-security.co.uk/news/96982",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.kb.cert.org/vuls/id/403150",
      "tags": [
        "US Government Resource"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.microsoft.com/technet/security/advisory/943521.mspx",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/archive/1/481493/100/100/threaded",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/archive/1/481505/100/0/threaded",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/archive/1/481624/100/0/threaded",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/archive/1/481664/100/0/threaded",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/archive/1/481671/100/0/threaded",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/archive/1/481680/100/0/threaded",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/archive/1/481839/100/0/threaded",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/archive/1/481846/100/0/threaded",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/archive/1/481867/100/0/threaded",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/archive/1/481871/100/0/threaded",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/archive/1/481881/100/0/threaded",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/archive/1/481887/100/0/threaded",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/archive/1/482090/100/0/threaded",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/archive/1/482292/100/0/threaded",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/archive/1/482437/100/0/threaded",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/archive/1/484186/100/0/threaded",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/25945",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securitytracker.com/id?1018822",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.us-cert.gov/cas/techalerts/TA07-317A.html",
      "tags": [
        "US Government Resource"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://xs-sniper.com/blog/remote-command-exec-firefox-2005/",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2007/ms07-061",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A4581",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The URL handling in Shell32.dll in the Windows shell in Microsoft Windows XP and Server 2003, with Internet Explorer 7 installed, allows remote attackers to execute arbitrary programs via invalid \"%\" sequences in a mailto: or other URI handler, as demonstrated using mIRC, Outlook, Firefox, Adobe Reader, Skype, and other applications. NOTE: this issue might be related to other issues involving URL handlers in Windows systems, such as CVE-2007-3845. There also might be separate but closely related issues in the applications that are invoked by the handlers."
    },
    {
      "lang": "es",
      "value": "El manejo de URL en la biblioteca Shell32.dll en el shell de Windows en Microsoft Windows XP y Server 2003, con Internet Explorer versión 7 instalado, permite a atacantes remotos ejecutar programas arbitrarios por medio de secuencias \"%\" no válidas en un mailto: u otro manejador URI, como es demostrado usando mIRC, Outlook, Firefox, Adobe Reader, Skype y otras aplicaciones. NOTA: este problema podría estar relacionado con otros problemas relacionados con los controladores de URL en sistemas Windows, tal y como CVE-2007-3845. También puede haber problemas separados pero estrechamente relacionados en las aplicaciones que son invocadas por los manejadores."
    }
  ],
  "lastModified": "2026-06-16T22:42:59.390",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:microsoft:windows_2003_server:*:*:itanium:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "580632FB-7EB8-4DC6-A372-742D4523BF79"
            },
            {
              "criteria": "cpe:2.3:o:microsoft:windows_2003_server:*:*:x64:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "CD264C73-360E-414D-BE22-192F92E5A0A3"
            },
            {
              "criteria": "cpe:2.3:o:microsoft:windows_2003_server:*:sp1:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "FE8F4276-4D97-480D-A542-FE9982FFD765"
            },
            {
              "criteria": "cpe:2.3:o:microsoft:windows_2003_server:*:sp2:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "2978BF86-5A1A-438E-B81F-F360D0E30C9C"
            },
            {
              "criteria": "cpe:2.3:o:microsoft:windows_2003_server:*:sp2:itanium:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "F7EFB032-47F4-4497-B16B-CB9126EAC9DF"
            },
            {
              "criteria": "cpe:2.3:o:microsoft:windows_2003_server:*:sp2:x64:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "6881476D-81A2-4DFD-AC77-82A8D08A0568"
            },
            {
              "criteria": "cpe:2.3:o:microsoft:windows_xp:*:*:x64:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "ACF75FC8-095A-4EEA-9A41-C27CFF3953FB"
            },
            {
              "criteria": "cpe:2.3:o:microsoft:windows_xp:*:sp2:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "9B339C33-8896-4896-88FF-88E74FDBC543"
            },
            {
              "criteria": "cpe:2.3:o:microsoft:windows_xp:*:sp2:x64:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "57ECAAA8-8709-4AC7-9CE7-49A8040C04D3"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:microsoft:internet_explorer:7.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6BC71FD8-D385-4507-BD14-B75FDD4C79E6"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "sourceIdentifier": "secure@microsoft.com"
}