The flaw, confirmed on a fully patched system with Windows XP and Service Pack 2 as well as Windows Server 2003, can be exploited from a remote location to cause a DoS attack on certain applications, according to Secunia.
The flaw is caused by a boundary error in inetcomm.dll within the processing of URLs with the "mhtml:" handler and can be exploited to cause a stack-based buffer overflow via an overly long URL. A user must first be tricked into visiting a malicious website with Internet Explorer or opening a malicious internet shortcut, according to Secunia.
"Successful exploitation crashed the application using the vulnerability library," warned Secunia in an advisory released last Thursday. "Execution of arbitrary code may be possible, but has currently not been proven as it is prevented by the (data execution prevention) mechanism."
Microsoft’s next Patch Tuesday release is scheduled for June 13. The Redmond, Wash., company is also working on a patch for a prevalent flaw in Microsoft Word that can be used for remote execution of malicious code.
