Cross-Domain Information Disclosure in Microsoft Outlook Express and Windows Mail

CVE-2008-1448

Summary

A vulnerability in the MHTML protocol handler of Microsoft Outlook Express 5.5 SP2 and 6 SP1, along with Windows Mail, could allow remote attackers to bypass intended access restrictions. This occurs due to incorrect assignment of Internet Explorer Security Zones to UNC share pathnames. Attackers can exploit this flaw to read arbitrary files from the affected devices by utilizing an mhtml: URI in combination with a redirection, highlighting the importance of securing email clients against such cross-domain information disclosure threats.

References