Security Intelligence Operations

Microsoft Windows Vista contains a vulnerability in the Feed Headlines Gadget that could allow an unauthenticated, remote attacker to execute arbitrary code.

The vulnerability is due to insufficient validation of user- supplied input passed to the Feed Headlines Gadget. An attacker who can convince a user that has enabled the gadget to subscribe to a malicious RSS feed could exploit this vulnerability. A successful exploit could allow the attacker to execute arbitrary code with user privileges.

Microsoft has confirmed this vulnerability in a security bulletin and released software updates.

The following Microsoft products are vulnerable:

Microsoft Windows Vista
Microsoft Windows Vista x64 Edition

The Feed Headlines Gadget is often enabled on OEM builds of Windows Vista by default. An attacker cannot directly exploit this vulnerability, and instead must rely on user interaction to perform an exploit. An attacker may utilize social engineering techniques to convince a user to subscribe to an RSS feed that appears safe, and then at some later date push a malicious article to the affected system.

Because of the additional restrictions placed on user and administrative accounts within Windows Vista, it is unlikely that exploitation would result in a complete system compromise.

Microsoft has corrected the vulnerability by adding additional checks to HTML attributes received by the Feed Headlines Gadget.

Microsoft has released a security bulletin at the following link: MS07-048 

US-CERT has released a vulnerability note at the following link: VU#558648