New Search

URL Parsing Cross-Domain Information Disclosure Vulnerability

oval:org.mitre.oval:def:5886

The MHTML protocol handler in a component of Microsoft Outlook Express 5.5 SP2 and 6 through SP1 and Windows Mail does not assign the correct Internet Explorer Security Zone to UNC share pathnames which allows remote attackers to bypass intended access restrictions and read arbitrary files via an mhtml: URI in conjunction with a redirection aka "URL Parsing Cross-Domain Information Disclosure Vulnerability."

Family:
windows
Status:
ACCEPTED
Platform(s):
  • Microsoft Windows Vista
  • Microsoft Windows Server 2003
  • Microsoft Windows XP
  • Microsoft Windows Server 2008
  • Microsoft Windows 2000
Class:
vulnerability
Reference(s):
  • CVE-2008-1448
Product(s):
  • Microsoft Mail
  • Microsoft Outlook Express