funsec mailing list archives
Yet Another IE Bug: "mhtml:" Redirection Disclosure of Sensitive Infor mation
From: "Fergie" <fergdawg () netzero net>
Date: Thu, 27 Apr 2006 16:00:14 GMT
Via Secunia. [snip] Description: codedreamer has discovered a vulnerability in Internet Explorer, which can be exploited by malicious people to disclose potentially sensitive information. The vulnerability is caused due to an error in the handling of redirections for URLs with the "mhtml:" URI handler. This can be exploited to access documents served from another web site. Secunia has constructed a test, which is available at: http://secunia.com/Internet_Explorer_Arbitrary_Content_Disclosure_Vulnerability_Test/ The vulnerability has been confirmed on a fully patched system with Internet Explorer 6.0 and Microsoft Windows XP SP2. Other versions may also be affected. Solution: Disable active scripting support. [snip] More: http://secunia.com/advisories/19738/ - ferg -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg () netzero net or fergdawg () sbcglobal net ferg's tech blog: http://fergdawg.blogspot.com/ _______________________________________________ Fun and Misc security discussion for OT posts. https://linuxbox.org/cgi-bin/mailman/listinfo/funsec Note: funsec is a public and open mailing list.
Current thread:
- Yet Another IE Bug: "mhtml:" Redirection Disclosure of Sensitive Infor mation Fergie (Apr 27)