Microsoft has released a security bulletin relating to a vulnerability affecting all versions of Windows. Internet Explorer is the only known attack vector.
In a published security bulletin, Microsoft has warned of a script vulnerability affecting all versions of Windows which has been publically divulged. It is linked to a problem in the way MHTML treats MIME requests formatted for blocks of content in a document.
MIME Encapsulation of Aggregate HTML is a Web page protocol which brings together numerous formats in a single file. For browsers, only Internet Explorer and Opera natively support this (although Firefox offers support via an extension). For the moment, the only known exploitation vector is Internet Explorer.
Microsoft compares the impact of an attack exploiting the vulnerability (which resides in a Windows component) to that of XSS vulnerability (cross-site scripting) on the server side. The software giant explains that an attacker could, for example, build a HTML link to run a malicious script which executes on the victim’s computer the whole time their Internet Explorer session is open. This script could collect user information (e-mail), and spy on displayed content.
While awaiting the publication of a corrective patch, Microsoft has proposed a radical protection method with a Fix it that disables the MHTML protocol.
