MSVC 6.0 run file bug – Generally authors offer code as a project with source, headers, and msvc project files if it is a fairly big project. Most users will simply open up the project.dsw file, ( especialy if it says to do so in a readme.txt or other compiler instructions ) which in turn loads the project.dsp files, which provides the compiler directives. A malicious attacker could embed commands to be executed in the project files, and execute any local code of his choosing.
You can download this advisory from the following link: https://packetstormsecurity.com/files/download/43379/msvc-featurebug.txt
Source: https://packetstormsecurity.com/files/43379/msvc-featurebug.txt.html