Secunia

CERT/CC has reported a security issue in Windows, which can be exploited by malicious people to bypass certain security settings.

AutoPlay is a feature designed to immediately begin reading from a drive (e.g. run a setup file) when a media is inserted. According to Microsoft, this feature can be disabled for all drives by setting the value of the "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun" registry key to "0xFF". However, as Windows Vista fails to properly handle the mentioned registry key, this may still result in programs being executed automatically when a media is inserted even with the registry key value set to "0xFF".

Successful exploitation may result in execution of arbitrary code, but requires physical access to a vulnerable system or that a user is tricked into inserting a malicious media (e.g. USB device).

Solution
Apply patches.
Further details available in Customer Area

Provided and/or discovered by
Will Dormann and Jeff Gennari, CERT/CC.

Changelog
Further details available in Customer Area

Original Advisory
US-CERT VU#889747:
http://www.kb.cert.org/vuls/id/889747

MS08-038 (KB950582):
http://www.microsoft.com/technet/security/Bulletin/MS08-038.mspx

Microsoft KB967715:
http://support.microsoft.com/kb/967715

Microsoft Security Advisory (967940):
http://www.microsoft.com/technet/security/advisory/967940.mspx

Deep Links
Links available in Customer Area