ran across this accidentally. from MS08-038: "Besides the changes that are listed in the .Vulnerability Details. section of this bulletin, this security update also resolves a publicly known issue with Autorun functionality ... This corrects the issue identified in CVE-2008-0951 on Windows Vista and Windows Server 2008."