Folder GUID Code Execution Vulnerability
Microsoft Internet Explorer 6.0 does not properly handle Drag and Drop events which allows remote user-assisted attackers to execute arbitrary code via a link to an SMB file share with a filename that contains encoded ..\ (%2e%2e%5c) sequences and whose extension contains the CLSID Key identifier for HTML Applications (HTA) aka "Folder GUID Code Execution Vulnerability." NOTE: directory traversal sequences were used in the original exploit although their role is not clear.
- Microsoft Windows 2000
- Microsoft Windows Server 2003
- Microsoft Windows XP