windows_mail,outlook_express 安全绕过信息泄露任意文件读取漏洞

CVE编号

CVE-2008-1448

利用情况

暂无

补丁情况

N/A

披露时间

2008-08-13

漏洞描述

The MHTML protocol handler in a component of Microsoft Outlook Express 5.5 SP2 and 6 through SP1, and Windows Mail, does not assign the correct Internet Explorer Security Zone to UNC share pathnames, which allows remote attackers to bypass intended access restrictions and read arbitrary files via an mhtml: URI in conjunction with a redirection, aka "URL Parsing Cross-Domain Information Disclosure Vulnerability."

解决建议

建议您更新当前系统或软件至最新版，完成漏洞的修复。

参考链接
http://marc.info/?l=bugtraq&m=121915960406986&w=2
http://secunia.com/advisories/31415
http://www.coresecurity.com/content/internet-explorer-zone-elevation
http://www.securityfocus.com/archive/1/495458/100/0/threaded
http://www.securityfocus.com/bid/30585
http://www.securitytracker.com/id?1020679
http://www.securitytracker.com/id?1020680
http://www.us-cert.gov/cas/techalerts/TA08-225A.html
http://www.vupen.com/english/advisories/2008/2352
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-048
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.ova...

受影响软件情况

#	类型	厂商	产品	版本	影响面
1
	运行在以下环境
	应用	microsoft	outlook_express	5.5	-
	运行在以下环境
	应用	microsoft	outlook_express	6.0	-
	运行在以下环境
	应用	microsoft	windows_mail	*	-

CVSS3评分 7.1

• 攻击路径 网络
• 攻击复杂度 N/A
• 权限要求 无
• 影响范围 N/A
• 用户交互 需要
• 可用性 无
• 保密性 完全地
• 完整性 无

AV:N/AC:M/Au:N/C:C/I:N/A:N CWE-ID 漏洞类型 CWE-264 权限、特权和访问控制