Zero-Day Information Disclosure Vulnerability in Microsoft MHTML Protocol Handler
( Microsoft Security Advisory 2501696, CVE-2011-0096 )
Summary
An information disclosure vulnerability has been reported in the Microsoft Windows MHTML protocol handler. This vulnerability could allow an attacker to cause malicious scripts to be run on the targeted machine when visiting various Web sites, resulting in information disclosure.
Details
MHTML (MIME Encapsulation of Aggregate HTML) is an Internet standard that defines the MIME structure that is used to wrap HTML content. The MHTML protocol handler in Windows provides a protocol (MHTML:) that permits MHTML encoded documents to be rendered in applications.
The vulnerability is due to the way MHTML interprets MIME-formatted requests for content blocks within a document. It is possible under certain conditions for this vulnerability to allow an attacker to inject a client-side script in response to a Web request generated by Internet Explorer on the targeted machine. The script could spoof content, disclose information, or take any action that the user could take on the affected Web site on behalf of the targeted user.
Affected Products
The following versions of Windows are affected by this issue:
- Windows XP SP3 and XP Professional x64 Edition SP2
- Windows Server 2003 SP2, x64 Edition SP2, and SP2 Itanium
- Windows Vista SP1, SP2, x64 Edition SP1, and x64 Edition SP2
- Windows Server 2008 for 32-bit Systems - original release and SP2
- Windows Server 2008 for x64-based Systems - original release and SP2
- Windows Server 2008 (Itanium) - original release and SP2
- Windows 7 for 32-bit and x64-based Systems
- Windows Server 2008 R2 for x64-based Systems
- Windows Server 2008 R2 (Itanium)
Solution
No patch has been announced by Microsoft as of February 8, 2011. Until a patch is released, Check Point IPS Software Blade and SmartDefense provide network protection against these vulnerabilities in the latest IPS update by detecting and blocking attempts to exploit them. For more information see CPAI-2011-006.
Originally Published:
Last Updated: 08-Feb-2011