Argument Injection Vulnerability in Microsoft Internet Explorer Affecting Windows Systems

CVE-2007-3924

Summary

An argument injection vulnerability exists in Microsoft Internet Explorer that affects systems where Netscape is installed. This flaw enables remote attackers to exploit cross-browser scripting attacks by manipulating shell metacharacters within a -chrome argument to the navigatorurl URI. When invoked, these commands are inserted into the execution command line for netscape.exe, creating a risk of arbitrary command execution. There remains some contention regarding whether the vulnerability primarily resides within Internet Explorer or Netscape, though it is generally acknowledged that Internet Explorer fails to adequately delimit the URL argument when calling Netscape, highlighting potential risks with other protocol handlers.

References