Windows Explorer caches the result of ZoneID lookups. If a file is overwritten, Explorer does not properly update this cached information to reflect the new ZoneID. This allows spoofing of trusted or non-existant ZoneIDs by overwriting files with trusted or non-existent ZoneIDs.
The following steps illustrate the problem.
> copy c:\windows\notepad.exe test.exe> copy evil.exe test.exeExploiting this issue requires the ability to overwrite existing files which have a trusted or non-existant ZoneID. Right now there is no known way to achieve this in an attack mounted from the Internet.
heise Security has notified Microsoft about both issues on August 12. Microsoft Security Response Center responded:
"We have investigated your report, as we do with all reports, however in this case, we don't see these issues as being in conflict with the design goals of the new protections. We are always seeking improvements to our security protections and this discussion will certainly provide additional input into future security features and improvements, but at this time we do not see these as issues that we would develop patches or workarounds to address."
You find some personal thoughts about this response in the latest comment on heise Security: Microsoft: A matter of trust
Themen-Forum Desktopsicherheit
Am 15. Januar 2012 jährte sich der Versand einer inzwischen berühmten E-Mail zum zehnten Mal: Bill Gates machte die Themen Sicherheit, Datenschutz und Verlässlichkeit von IT-Systemen zum obersten Ziel. 
Dank der redaktionseigenen Glaskugel präsentiert heise Security schon jetzt und wie immer exklusiv den ultimativen Jahresrückblick auf das vor uns liegende Jahr 2012. 
Bei einem Hackerangriff auf die FTP-Server des Groupware-Anbieters haben Unbekannte eine Backdoor in einige Installationspakete eingebaut. Der Angriff blieb vier Monate unbemerkt. 
