A URI that calls a program in Windows actually asks the Windows Shell32 program to do its bidding. Shell32 uses the ShellExecute function to start the other program. The trouble is that Shell32's a trusting sort, not asking any questions about what the URI is up to. As a result, a bad URI can do anything it wants.
Microsoft Steps Up to Stop URI Attacks via Windows XP, Windows Server 2003
Adobe fixed the problem for Acrobat and Reader 8.x users right away, but, as Symantec's list of other affected applications suggests, the real place to stop the problem is at the operating system level. And, with the release of security bulletin MS07-061, Microsoft is on the job. Tuesday, Microsoft rolled out the URI vulnerability fix for Windows XP and Windows Server 2003 as part of "Patch Tuesday," so it will be showing up in your system's Windows Update offerings shortly. But why wait? You can grab the update for Windows XP right now (Windows Vista users aren't affected). It's a 3MB download, so it won't take long to download and install it. Microsoft identifies this vulnerability as "critical" - and given the omnipresence of URIs, that's putting it mildly.
Can MS07-061 Break Your Favorite Application?
Changing how Shell32 works is not trivial - it's one of the most important components in Windows. Unfortunately, it's possible that the security changes in this new update might cause some programs to no longer work properly. If that happens, you will need to whip out Regedit and make changes to the Registry that will exempt that program from the security update. For details, see Microsoft Knowledge Base article 943460.
Mark Soper and tech legend Leo Laporte have teamed up to solve Windows XP woes with Leo Laporte's PC Help Desk. Grab a copy for yourself or give PC peace of mind to friends and family. It's available at Amazon.com and other fine bookstores.