4.3 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:M/Au:N/C:P/I:N/A:N
0.079 Low
EPSS
Percentile
94.2%
Microsoft Windows βMHTMLβ protocol handler fails to properly interpret URL redirections, which may cause information disclosure.
The Microsoft Windows βMHTMLβ protocol handler contains an information disclosure vulnerability in the way that it interprets URL redirections. The βMHTMLβ protocol handler fails to properly interpret HTTP server-side redirect through the βMHTMLβ protocol, which may allow Internet Explorer to bypass Internet Explorer domain restrictions.
By convincing a user to visit a specially crafted website, a remote, unauthenticated attacker may be able to access sensitive information.
Apply an update
This issue is addressed by Microsoft Security Bulletin MS07-034.
Workarounds
Microsoft has provided the following workarounds to address this issue:
Disable the MHTML protocol handler.
1. Click Start and then click Run. Enter regedit.exe in the text box and click OK.
2. Navigate to HKEY_CLASSES_ROOT\CLSID\{05300401-BCBC-11d0-85E3-00C04FD85AB4}.
3. Right click {05300401-BCBC-11d0-85E3-00C04FD85AB4} and select Permissions.
4. Click Advanced.
5. Uncheck Allow inheritable permissions from the parent to propagateβ¦
6. Click Remove, and then click OK. Click Yes and OKon subsequent screens.
Impact of workaround: This workaround disables page rendering for MHTML Web pages.
Configure Internet Explorer to prompt before running Active Scripting or to disable Active Scripting in the Internet and Local intranet security zone.
783761
Filter by status: All Affected Not Affected Unknown
Filter by content: __ Additional information available
__ Sort by: Status Alphabetical
Expand all
Javascript is disabled. Click here to view vendors.
Updated: June 13, 2007
Affected
We have not received a statement from the vendor.
The vendor has not provided us with any further information regarding this vulnerability.
This issue is addressed by Microsoft Security Bulletin MS07-034.
If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23783761 Feedback>).
Group | Score | Vector |
---|---|---|
Base | ||
Temporal | ||
Environmental |
<http://www.microsoft.com/technet/security/bulletin/ms07-034.mspx>
This vulnerability was reported in Microsoft Security Bulletin MS07-034.
This document was written by Katie Steiner
CVE IDs: | CVE-2006-2111 |
---|---|
Severity Metric: | 1.80 Date Public: |