Test ID:	1.3.6.1.4.1.25623.1.0.801716
Category:	Windows : Microsoft Bulletins
Title:	Microsoft Outlook Express/Windows Mail MHTML URI Handler Information Disclosure Vulnerability (929123)
Summary:	This host is missing a critical security update according to; Microsoft Bulletin MS07-034.
Description:	Summary: This host is missing a critical security update according to Microsoft Bulletin MS07-034. Vulnerability Insight: The flaw is due to - Error in Windows because the 'MHTML' protocol handler incorrectly interprets the MHTML URL redirections that could potentially bypass Internet Explorer domain restrictions. - The way local or UNC navigation requests are handled in Windows Mail. - Error in Windows because the 'MHTML' protocol handler incorrectly interprets HTTP headers when returning MHTML content. - MHTML protocol handler, which passes Content-Disposition notifications back to Internet Explorer. Vulnerability Impact: Successful exploitation allows remote attackers to gain access to sensitive information that is associated with the external domain. Affected Software/OS: - Microsoft Windows XP Service Pack 2 and prior - Microsoft Windows 2K3 Service Pack 2 and prior - Microsoft Windows Vista Solution: The vendor has released updates. Please see the references for more information. CVSS Score: 9.3 CVSS Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2006-2111 BugTraq ID: 17717 http://www.securityfocus.com/bid/17717 Bugtraq: 20061025 IE7 status: 8 days after release, 3 unfixed issues (Google Search) http://www.securityfocus.com/archive/1/449917/100/0/threaded Bugtraq: 20061026 IE7 is a Source of Problem - Secunia IE7 Release Incident of October 2006 (Google Search) http://www.securityfocus.com/archive/1/449883/100/200/threaded Cert/CC Advisory: TA07-163A http://www.us-cert.gov/cas/techalerts/TA07-163A.html CERT/CC vulnerability note: VU#783761 http://www.kb.cert.org/vuls/id/783761 HPdes Security Advisory: HPSBST02231 http://www.securityfocus.com/archive/1/471947/100/0/threaded HPdes Security Advisory: SSRT071438 http://secunia.com/Internet_Explorer_Arbitrary_Content_Disclosure_Vulnerability_Test/ Microsoft Security Bulletin: MS07-034 https://docs.microsoft.com/en-us/security-updates/securitybulletins/2007/ms07-034 http://www.osvdb.org/25073 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1605 http://securitytracker.com/id?1016005 http://secunia.com/advisories/19738 http://secunia.com/advisories/22477 http://www.vupen.com/english/advisories/2006/1558 http://www.vupen.com/english/advisories/2007/2154 XForce ISS Database: ie-mhtml-information-disclosure(26281) https://exchange.xforce.ibmcloud.com/vulnerabilities/26281 Common Vulnerability Exposure (CVE) ID: CVE-2007-1658 BugTraq ID: 23103 http://www.securityfocus.com/bid/23103 http://archives.neohapsis.com/archives/fulldisclosure/2007-03/0344.html http://archives.neohapsis.com/archives/fulldisclosure/2007-03/0345.html http://archives.neohapsis.com/archives/fulldisclosure/2007-03/0346.html http://isc.sans.org/diary.html?storyid=2507 http://news.com.com/2100-1002_3-6170133.html http://www.computerworld.com/action/article.do?command=viewArticleBasic&articleId=9014194 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1861 http://www.securitytracker.com/id?1017816 http://secunia.com/advisories/25639 XForce ISS Database: win-mail-code-execution(33167) https://exchange.xforce.ibmcloud.com/vulnerabilities/33167 Common Vulnerability Exposure (CVE) ID: CVE-2007-2225 BugTraq ID: 24392 http://www.securityfocus.com/bid/24392 Bugtraq: 20070622 MS07-034: Executing arbitrary script with mhtml: protocol handler (Google Search) http://www.securityfocus.com/archive/1/472002/100/0/threaded CERT/CC vulnerability note: VU#682825 http://www.kb.cert.org/vuls/id/682825 http://archive.openmya.devnull.jp/2007.06/msg00060.html http://openmya.hacker.jp/hasegawa/security/ms07-034.txt http://osvdb.org/35345 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A2045 http://www.securitytracker.com/id?1018231 http://www.securitytracker.com/id?1018232 Common Vulnerability Exposure (CVE) ID: CVE-2007-2227 BugTraq ID: 24410 http://www.securityfocus.com/bid/24410 http://osvdb.org/35346 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A2085 http://www.securitytracker.com/id?1018233 http://www.securitytracker.com/id?1018234
Copyright	Copyright (C) 2011 Greenbone AG

This is only one of 146377 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.