An attacker could not exploit this vulnerability without user interaction. The attacker must convince a user to view a malicious document, likely provided as an attachment to an e-mail message, or by convincing a user to follow a link to a file that is shared on a remote file share or website. If opened, the document could trigger the execution of arbitrary code on the system with the privileges of the user.
Microsoft has released a security advisory that explains insecure library loading vulnerabilities at the following link: 2269637. The .dll preloading behavior has been documented in Alert 21215. This vulnerability is similar to, but separate from, the vulnerability documented in Alert 21244.
The Cisco Applied Intelligence team has created an Applied Mitigation Bulletin to address vulnerabilities that Microsoft disclosed in the November 2010 security bulletin release. This Cisco bulletin, which assists administrators in identifying or mitigating these vulnerabilities using Cisco devices, is available at the following link: Cisco Applied Mitigation Bulletin: Microsoft Security Bulletin Release for November 2010