The buffer overflow vulnerability allows attackers to execute arbitrary code, hence compromising the targeted system. The security flaw is very easy to exploit.
"The MP3 does not need to be played, it simply needs to be stored in a folder that is browsed to, such as an MP3 download folder, the desktop, or a NetBIOS share," Foundstone said in their advisory.
"Explorer automatically reads file attributes regardless of whether or not the user actually highlights, clicks on, reads, or opens the file... This vulnerability is also exploitable via Internet Explorer by loading a malicious Web site."
"...if the user browses to a malicious Web site with Internet Explorer directly, the attack will work regardless of the Internet Explorer security settings."
Microsoft have released a fix, and have rated the vulnerability as critical.
Windows 2000 and other Microsoft operating systems are not affected.
Foundstone also released an advisory that outlines similar flaws in Winamp, the popular mp3 player software. "One buffer overflow exists in Winamp 2.81 (latest 2.x release) and two buffer overflows exist in Winamp 3.0 (latest 3.x release)." it said. Nullsoft, the makers of Winamp, have released patched versions of their software.
