Certain versions of Internet Explorer 5 and 6 in certain Windows environments allow remote attackers to cause a denial of service (freeze) via a URL to C:\\aux (MS-DOS device name) and possibly other devices.