HTTP: Internet Explorer MHT Redirect

This signature detects attempts to bypass Internet Explorer's security zones. A remote user can create a page in the Internet security zone that contains an IFRAME that uses MhtRedirParsesLocalFile to parse a local file. Using a URL of the format "mhtml:url!original_url", IE attempts to download the "original_url".

Extended Description

A vulnerability has been in sub-frames in Microsoft Internet Explorer. Because of this, an attacker may be able to violate cross-domain policy. This could permit script code to access properties of other domains or execute in the context of the Local Zone. Exploitation of this issue in combination with other vulnerabilities could allow for execution of a malicious executable on a vulnerable system.

Affected Products

Microsoft internet_explorer

References

BugTraq: 9109

CVE: CVE-2003-1026

URL: http://www.us-cert.gov/cas/techalerts/TA04-033A.html http://www.securitytracker.com/alerts/2003/Nov/1008292.html http://www.microsoft.com/technet/security/bulletin/ms04-004.asp

Short Name

HTTP:STC:IE:IE-MHT-REDIRECT

Severity

Minor

Recommended

False

Recommended Action

Drop

HTTP: Internet Explorer MHT Redirect

Extended Description

Affected Products

References

Found a potential security threat?