[Japanese]

JVNDB-2007-000447

Internet Explorer vulnerable in handling MHTML protocol

Overview

Internet Explorer is vulnerable in handling MHTML (MIME Encapsulation of Aggregate HTML) protocol, which allows the download dialog box to be bypassed.

Some versions of Outlook Express are affected because the vulnerability is contained in Outlook Express component used by Internet Explorer.

When Internet Explorer accesses a website using MHTML (MIME Encapsulation of Aggregate HTML), Internet Explorer processes the contents as MHTML data, ignoring their actual content types, and it does not properly handle the Content-Disposition header field. This could cause a dialog box not to be displayed when downloading.
The MHTML protocol handler is included in Outlook Express component, and Microsoft provides the fix for this componet.
CVSS Severity (What is CVSS?)

CVSS V2 Severity:
Base Metrics 2.6 (Low) [IPA Score]
  • Access Vector: Network
  • Access Complexity: High
  • Authentication: None
  • Confidentiality Impact: None
  • Integrity Impact: Partial
  • Availability Impact: None
Affected Products


Microsoft Corporation
  • Microsoft Outlook Express 6
  • Microsoft Windows Mail
  • Microsoft Windows Server 2003
  • Microsoft Windows Server 2003 (itanium)
  • Microsoft Windows Server 2003 (x64)
  • Microsoft Windows Vista
  • Microsoft Windows Vista (x64)
  • Microsoft Windows XP sp3
  • Microsoft Windows XP (x64)

Impact

An arbitrary script could be executed without explicit user consent, as the download dialog box is not displayed on the user's IE.
Solution

[Update the Software]

Apply the updates provided by the vendor.

For more information, refer to the vendor's website.
Vendor Information

Microsoft Corporation
  • Microsoft Security Bulletin : MS07-034
CWE (What is CWE?)

CVE (What is CVE?)

  1. CVE-2007-2227
References

  1. JVN : JVNTA07-163A (Japanese)
  2. JVN : JVN#95019167
  3. JVN Status Tracking Notes : TRTA07-163A (Japanese)
  4. National Vulnerability Database (NVD) : CVE-2007-2227
  5. US-CERT Cyber Security Alerts : SA07-163A
  6. US-CERT Technical Cyber Security Alert : TA07-163A
  7. Secunia Advisory : SA25639
  8. SecurityFocus : 24410
  9. FrSIRT Advisories : FrSIRT/ADV-2007-2154
Revision History

  • [2008/05/21]
      Web page published