Signature Detail
Short Name |
HTTP:STC:MHTML-CDI |
|---|---|
Severity |
Low |
Recommended |
No |
Category |
HTTP |
Keywords |
MHTML Encoding Cross Domain Information Disclosure |
Release Date |
2007/06/12 |
Update Number |
1213 |
Supported Platforms |
idp-4.0+, isg-3.0+, j-series-9.5+, mx-9.4+, srx-9.2+, srx-branch-9.4+, vsrx-12.1+ |
HTTP: MHTML Encoding Cross Domain Information Disclosure
This signature detects MHTML links within Web pages using encoding to bypass domain data partitioning. Windows Internet Explorer 6 and 7 with Outlook Express and Windows Mail are affected. This vulnerability could allow an attacker access to information stored in cookies from other domains, including usernames, passwords, social security numbers, credit card numbers, and other sensitive data.
Extended Description
Outlook Express is prone to a cross-domain information-disclosure vulnerability. This vulnerability may let a malicious website access properties of a site in an arbitrary external domain in the context of the victim user's browser. Attackers could exploit this issue to gain access to sensitive information (such as cookies or passwords) that is associated with the external domain.
Affected Products
- Microsoft Outlook Express 6.0
- Microsoft Outlook Express 6.0 SP1
- Microsoft Outlook Express 6.0 SP2
- Microsoft Windows Mail
References
- BugTraq: 24392
- CVE: CVE-2007-2225
- URL: http://www.microsoft.com/technet/security/Bulletin/MS07-034.mspx