CVE-2006-4692
Argument injection vulnerability in the Windows Object Packager (packager.exe) in Microsoft Windows XP SP1 and SP2 and Server 2003 SP1 and earlier allows remote user-assisted attackers to execute arbitrary commands via a crafted file with a "/" (slash)…
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 29.2%, higher than 98% of all known CVEs. Patch or mitigate before the next change window.
Description
Argument injection vulnerability in the Windows Object Packager (packager.exe) in Microsoft Windows XP SP1 and SP2 and Server 2003 SP1 and earlier allows remote user-assisted attackers to execute arbitrary commands via a crafted file with a "/" (slash) character in the filename of the Command Line property, followed by a valid file extension, which causes the command before the slash to be executed, aka "Object Packager Dialogue Spoofing Vulnerability."
- CVSS 2.0
- 5.1 MEDIUMAV:N/AC:H/Au:N/C:P/I:P/A:P
- EPSS
- 29.23% probability · 98th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-88
- Affected
- microsoft/windows server 2003 · microsoft/windows xp
- Source
- secure@microsoft.com
References
- http://secunia.com/advisories/20717Broken Link, Vendor Advisory
- http://secunia.com/secunia_research/2006-54/advisory/Broken Link, Vendor Advisory
- http://securitytracker.com/id?1017037Broken Link, Third Party Advisory, VDB Entry
- http://www.kb.cert.org/vuls/id/703936Third Party Advisory, US Government Resource
- http://www.osvdb.org/29424Broken Link
- http://www.securityfocus.com/archive/1/448273/100/0/threadedBroken Link, Third Party Advisory, VDB Entry
- http://www.securityfocus.com/archive/1/448696/100/0/threadedBroken Link, Third Party Advisory, VDB Entry
- http://www.securityfocus.com/archive/1/449179/100/0/threadedBroken Link, Third Party Advisory, VDB Entry
- http://www.securityfocus.com/bid/20318Broken Link, Third Party Advisory, VDB Entry
- http://www.vupen.com/english/advisories/2006/3984Broken Link, Vendor Advisory
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-065Patch, Vendor Advisory
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A496Broken Link
- http://secunia.com/advisories/20717Broken Link, Vendor Advisory
- http://secunia.com/secunia_research/2006-54/advisory/Broken Link, Vendor Advisory
- http://securitytracker.com/id?1017037Broken Link, Third Party Advisory, VDB Entry
- http://www.kb.cert.org/vuls/id/703936Third Party Advisory, US Government Resource
- http://www.osvdb.org/29424Broken Link
- http://www.securityfocus.com/archive/1/448273/100/0/threadedBroken Link, Third Party Advisory, VDB Entry
- http://www.securityfocus.com/archive/1/448696/100/0/threadedBroken Link, Third Party Advisory, VDB Entry
- http://www.securityfocus.com/archive/1/449179/100/0/threadedBroken Link, Third Party Advisory, VDB Entry
- http://www.securityfocus.com/bid/20318Broken Link, Third Party Advisory, VDB Entry
- http://www.vupen.com/english/advisories/2006/3984Broken Link, Vendor Advisory
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-065Patch, Vendor Advisory
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A496Broken Link
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.