CVE-2003-0907

MEDIUM 5.1CVE-2003-0907 · Published 01/06/2004 · updated 16/06/2026

Package	Affected versions	Patched versions
—	No affected product versions are listed for this vulnerability yet.

Description

Help and Support Center in Microsoft Windows XP SP1 does not properly validate HCP URLs, which allows remote attackers to execute arbitrary code via quotation marks in an hcp:// URL, which are not quoted when constructing the argument list to HelpCtr.exe.

References

lists.grok.org.uk/pipermail/full-disclosure/2004-April/020065.html · Broken Link
marc.info · Third Party Advisory
ciac.org/ciac/bulletins/o-114.shtml · Broken Link
idefense.com/application/poi/display · Broken Link
kb.cert.org/vuls/id/260588 · Patch
securityfocus.com/bid/10119 · Broken Link
us-cert.gov/cas/techalerts/TA04-104A.html · Broken Link
docs.microsoft.com/en-us/security-updates/securitybulletins/2004/ms04-011 · Patch
exchange.xforce.ibmcloud.com/vulnerabilities/15704 · Third Party Advisory
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1000 · Broken Link
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A904 · Broken Link

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free