Microsoft is investigating new public reports of a vulnerability in older versions of Microsoft Internet Explorer. Based on our investigation, this vulnerability could allow an attacker to execute arbitrary code on the user’s system in the security context of the logged-on user. The attacker could do this by one or more of the following actions:
• By hosting a specially crafted Windows Metafile (WMF) image on a malicious Web site;
• By convincing a user to open a specially crafted e-mail attachment;
• By convincing a user to click on a link in an e-mail message that takes the user to a malicious Web site; or
• By sending a specially crafted e-mail message to Outlook Express users, which they view in the preview pane.
The vulnerability exists in:
• Internet Explorer 5.01 Service Pack 4 on Microsoft Windows 2000 Service Pack 4
• Internet Explorer 5.5 Service Pack 2 on Microsoft Windows Millennium.
The vulnerability does not exist in:
• Internet Explorer for Microsoft Windows XP Service Pack 1 and Windows XP Service Pack 2
• Internet Explorer for Microsoft Windows XP Professional x64 Edition
• Internet Explorer for Microsoft Windows Server 2003 and Windows Server 2003 Service Pack 1
• Internet Explorer for Windows Server 2003 for Itanium-based Systems
• Internet Explorer for Windows Server 2003 with Service Pack 1 for Itanium-based Systems
• Internet Explorer for Windows Server 2003 x64 Edition
• Internet Explorer 6 Service Pack 1 on Microsoft Windows 2000 Service Pack 4
• Internet Explorer 6 Service Pack 1 on Microsoft Windows 98
• Internet Explorer 6 Service Pack 1 on Microsoft Windows 98 Second Edition
• Internet Explorer 6 Service Pack 1 on Windows Millennium Edition
