Effects
MS07-004 is not categorized as virus, worm, Trojan or backdoor. It is a critical vulnerability in Vector Markup Language (VML) in Internet Explorer versions 5.01 and 6 on Windows 2000 computers and version 7 on Windows 2003/XP, which allows arbitrary code to be remotely executed in the vulnerable computer.
Vector Markup Language (VML) is an XML-based exchange, editing, and delivery format for high-quality vector graphics on the web that meets the needs of both productivity users and graphic design professionals.
However, there is an unchecked buffer in the VML implementation, which causes the vulnerability.
If exploited successfully, MS07-004 allows hackers to gain remote control of the affected computer with the same privileges as the logged on user. If this user had administrator rights, the hacker could take complete control of the system: create, modify or delete files, install programs, create new user accounts, etc.
This vulnerability is usually exploited by creating a specially crafted web page and enticing users into accessing it. An email message in HTML format could also be used.
If you have any of the vulnerable Internet Explorer versions, it is recommended to download and apply the security patch for this vulnerability. Click here to access the web page for downloading the patch.
Additionally, bear in mind that this security bulletin replaces a previous bulletin, called MS06-055.