Executive Summary

Summary
Title Microsoft Windows "MHTML" protocol handler fails to properly handle URL redirections
Informations
Name VU#783761 First vendor Publication 2007-06-13
Vendor VU-CERT Last vendor Modification 2007-06-21
Severity (Vendor) N/A Revision M

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score NA
Base Score NA Environmental Score NA
impact SubScore NA Temporal Score NA
Exploitabality Sub Score NA
 
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:M/Au:N/C:P/I:N/A:N)
Cvss Base Score 4.3 Attack Range Network
Cvss Impact Score 2.9 Attack Complexity Medium
Cvss Expoit Score 8.6 Authentication None Required
Calculate full CVSS 2.0 Vectors scores

Detail

Vulnerability Note VU#783761

Microsoft Windows "MHTML" protocol handler fails to properly handle URL redirections

Overview

Microsoft Windows "MHTML" protocol handler fails to properly interpret URL redirections, which may cause information disclosure.

I. Description

The Microsoft Windows "MHTML" protocol handler contains an information disclosure vulnerability in the way that it interprets URL redirections. The "MHTML" protocol handler fails to properly interpret HTTP server-side redirect through the "MHTML" protocol, which may allow Internet Explorer to bypass Internet Explorer domain restrictions.

II. Impact

By convincing a user to visit a specially crafted website, a remote, unauthenticated attacker may be able to access sensitive information.

III. Solution

Apply an update

This issue is addressed by Microsoft Security Bulletin MS07-034.
Workarounds

Microsoft has provided the following workarounds to address this issue:

    Disable the MHTML protocol handler.

    1. Click Start and then click Run. Enter regedit.exe in the text box and click OK.
    2. Navigate to HKEY_CLASSES_ROOTCLSID{05300401-BCBC-11d0-85E3-00C04FD85AB4}.
    3. Right click {05300401-BCBC-11d0-85E3-00C04FD85AB4} and select Permissions.
    4. Click Advanced.
    5. Uncheck Allow inheritable permissions from the parent to propagate…
    6. Click Remove, and then click OK. Click Yes and OKon subsequent screens.
    Impact of workaround: This workaround disables page rendering for MHTML Web pages.


    Configure Internet Explorer to prompt before running Active Scripting or to disable Active Scripting in the Internet and Local intranet security zone.

    1. In Internet Explorer, click Internet Options on the Tools menu.
    2. Click the Security tab.
    3. Click Internet, and then click Custom Level.
    4. Under Settings, in the Scripting section, under Active Scripting, click Prompt or Disable, and then click OK.
    5. Click Local intranet, and then click Custom Level.
    6. Under Settings, in the Scripting section, under Active Scripting, click Prompt or Disable, and then click OK.
    7. Click OK two times to return to Internet Explorer.

Please see Microsoft Security Bulletin MS07-034 for further details.

Systems Affected

VendorStatusDate Updated
Microsoft CorporationVulnerable13-Jun-2007

References


http://www.microsoft.com/technet/security/bulletin/ms07-034.mspx

Credit

This vulnerability was reported in Microsoft Security Bulletin MS07-034.

This document was written by Katie Steiner

Other Information

Date Public06/12/2007
Date First Published06/13/2007 04:11:01 PM
Date Last Updated06/21/2007
CERT Advisory 
CVE NameCVE-2006-2111
Metric1.80
Document Revision15

Original Source

Url : http://www.kb.cert.org/vuls/id/783761

CWE : Common Weakness Enumeration

% Id Name
100 % CWE-200 Information Exposure

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:1605
 
Oval ID: oval:org.mitre.oval:def:1605
Title: URL Redirect Cross Domain Information Disclosure Vulnerability
Description: A component in Microsoft Outlook Express 6 allows remote attackers to bypass domain restrictions and obtain sensitive information via redirections with the mhtml: URI handler, as originally reported for Internet Explorer 6 and 7, aka "URL Redirect Cross Domain Information Disclosure Vulnerability."
Family: windows Class: vulnerability
Reference(s): CVE-2006-2111
 Version: 4
Platform(s): Microsoft Windows 2000
Microsoft Windows XP
Microsoft Windows Server 2003
 Product(s): Microsoft Outlook Express
Definition Synopsis:

CPE : Common Platform Enumeration

TypeDescriptionCount
Application 1

OpenVAS Exploits

Date Description
2011-01-14 Name : Microsoft Outlook Express/Windows Mail MHTML URI Handler Information Disclosu...
File : nvt/gb_ms07-034.nasl

Open Source Vulnerability Database (OSVDB)

Id Description
25073 Microsoft IE mhtml: Redirection Domain Restriction Bypass

Internet Explorer contains a flaw that may allow a malicious user to access documents served from another web site. The issue is caused due to an error in the handling of redirections for URLs with the "mhtml:" URI handler. It is possible that the flaw may allow a malicious website to access properties of a site in an arbitrary external domain in the context of the victim user's browser resulting in a loss of confidentiality.

Nessus® Vulnerability Scanner

Date Description
2007-06-12 Name : Arbitrary code can be executed on the remote host through the email client.
File : smb_nt_ms07-034.nasl - Type : ACT_GATHER_INFO

Alert History

If you want to see full details history, please login or register.
0
1
Date Informations
2015-05-08 13:28:08
  • Multiple Updates
2013-05-11 12:26:44
  • Multiple Updates