-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

===========================================================================
A  U  S  C  E  R  T                                           A  L  E  R  T

                       AL-2007.0077 -- AUSCERT ALERT
                                   [Win]
      Cumulative Security Update for Outlook Express and Windows Mail
                               13 June 2007

===========================================================================

        AusCERT Alert Summary
        ---------------------

Product:              Microsoft Windows
Publisher:            Microsoft
Operating System:     Windows
Impact:               Execute Arbitrary Code/Commands
                      Access Privileged Data
Access:               Remote/Unauthenticated
CVE Names:            CVE-2007-2227 CVE-2007-2225 CVE-2007-1658
                      CVE-2006-2111

Original Bulletin:    
  http://www.microsoft.com/technet/security/bulletin/ms07-034.mspx

Comment: Note that three of these vulnerabilities are exploitable when a user
         visits a malicious web page using Internet Explorer, even if Outlook
         Express and Windows Mail are not used. They allow a malicious website
         to read sensitive data from another website's domain.
         
         The fourth vulnerability allows execution of arbitrary code when the
         user clicks on a link in an email, using a remote or local UNC path.

- --------------------------BEGIN INCLUDED TEXT--------------------

MS07-034 - Cumulative Security Update for Outlook Express and Windows Mail (929123)

Affected Software:
    - Windows XP Service Pack 2
    - Windows XP Professional x64 Edition
    - Windows XP Professional x64 Edition Service Pack 2
    - Windows Server 2003 Service Pack 1 
    - Windows Server 2003 Service Pack 2 
    - Windows Server 2003 with SP1 for Itanium-based Systems 
    - Windows Server 2003 with SP2 for Itanium-based Systems 
    - Windows Server 2003 x64 Edition
    - Windows Server 2003 x64 Edition Service Pack 2
    - Windows Vista
    - Windows Vista x64 Edition

Non-Affected Software:
   -Windows 2000 Service Pack 4

Full MS07-034 advisory:
   http://www.microsoft.com/technet/security/bulletin/ms07-034.mspx


Vulnerability Details

URL Redirect Cross Domain Information Disclosure Vulnerability - CVE-2006-2111

    An information disclosure vulnerability exists in Windows because the
    MHTML protocol handler incorrectly interprets the MHTML URL redirections
    that could potentially bypass Internet Explorer domain restrictions. An
    attacker could exploit the vulnerability by constructing a specially
    crafted Web page. If the user viewed the Web page using Internet Explorer,
    the vulnerability could potentially allow information disclosure. An
    attacker who successfully exploited this vulnerability could read data
    from another Internet Explorer domain.

Windows Mail UNC Navigation Request Remote Code Execution 
Vulnerability - CVE-2007-1658

    A remote code execution vulnerability results from the way local or UNC
    navigation requests are handled in Windows Mail. An attacker could exploit
    the vulnerability by constructing a specially crafted e-mail message that
    could potentially allow execution of code from a local file or UNC path
    if a user clicked on a link in the e-mail message. An attacker who
    successfully exploited this vulnerability could take complete control of
    an affected system.

URL Parsing Cross Domain Information Disclosure Vulnerability - CVE-2007-2225

    An information disclosure vulnerability exists in Windows because the
    MHTML protocol handler incorrectly interprets HTTP headers when returning
    MHTML content. An attacker could exploit the vulnerability by constructing
    a specially crafted Web page. If the user viewed the Web page using
    Internet Explorer, the vulnerability could potentially allow information
    disclosure. An attacker who successfully exploited this vulnerability
    could read data from another Internet Explorer domain.

Content Disposition Parsing Cross Domain Information Disclosure 
Vulnerability - CVE-2007-2227

    An information disclosure vulnerability exists in the way MHTML protocol
    handler passes Content-Disposition notifications back to Internet Explorer.
    The vulnerability could allow an attacker to bypass the file download
    dialog box in Internet Explorer. An attacker could exploit the vulnerability
    by constructing a specially crafted Web page. If the user viewed the Web
    page using Internet Explorer, the vulnerability could potentially allow
    information disclosure. An attacker who successfully exploited this
    vulnerability could read data from another Internet Explorer domain.

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        http://www.auscert.org.au/render.html?cid=1980

If you believe that your computer system has been compromised or attacked in 
any way, we encourage you to let us know by completing the secure National IT 
Incident Reporting Form at:

        http://www.auscert.org.au/render.html?it=3192

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================

-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQCVAwUBRm8+pyh9+71yA2DNAQL7XwP+PG/Ynqbh3Q0ZUWxVAIvI9Dduzpl69n4R
Ia6exup6mIipkrjmHVq2kbhjVX8jbbAkbypJiYUct24cYqPS5KtvkXXPXK7B2RdI
09VC9m3ZELcbShyiW1By+lGauLwnxheIZzzpUu1V3N7zr7PJSZlOK3zXbHgRZXyw
KkDBsUyKjG0=
=x10I
-----END PGP SIGNATURE-----