PT-2007-3563 · Microsoft · Windows Vista+3

Published 2007-06-12 · Updated 2018-10-16 · CVE-2007-2225

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Microsoft Outlook Express version 6 Windows Mail in Windows Vista

Description A component does not properly handle certain HTTP headers when processing MHTML protocol URLs, allowing remote attackers to obtain sensitive information from other Internet Explorer domains.

Recommendations For Microsoft Outlook Express version 6, update to a version that properly handles HTTP headers for MHTML protocol URLs. For Windows Mail in Windows Vista, apply the necessary configuration changes to ensure proper handling of HTTP headers for MHTML protocol URLs.

Fix

Related Identifiers

CVE-2007-2225

Affected Products

Internet Explorer

Outlook Express

Windows Mail

Windows Vista

References · 15

• http://securityfocus.com/archive/1/471947/100/0/threaded · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2007-2225 · Security Note
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2007/ms07-034 · Vendor Advisory
• http://openmya.hacker.jp/hasegawa/security/ms07-034.txt · Note
• http://kb.cert.org/vuls/id/682825 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A2045 · Note
• http://osvdb.org/35345 · Note
• http://securityfocus.com/archive/1/472002/100/0/threaded · Note
• http://securitytracker.com/id?1018231 · Note
• http://us-cert.gov/cas/techalerts/TA07-163A.html · Note
• http://secunia.com/advisories/25639 · Note
• http://securityfocus.com/bid/24392 · Note
• http://securitytracker.com/id?1018232 · Note
• http://archive.openmya.devnull.jp/2007.06/msg00060.html · Note
• http://vupen.com/english/advisories/2007/2154 · Note