codedreamer has discovered a vulnerability in Internet Explorer and Outlook Express, which can be exploited by malicious people to disclose potentially sensitive information.

The vulnerability is caused due to an error in the handling of redirections for URLs with the "mhtml:" URI handler. This can be exploited to access documents served from another web site.

Secunia has constructed a test, which is available at:
http://secunia.com/Internet_Explorer_Arbitrary_Content_Disclosure_Vulnerability_Test/

The vulnerability has been confirmed on a fully patched system with Internet Explorer 6.0 and Microsoft Windows XP SP2. Other versions may also be affected.

Solution
Apply patches.
Further details available to Secunia VIM customers

Provided and/or discovered by
codedreamer

Changelog
Further details available to Secunia VIM customers

Original Advisory
MS07-034 (KB929123):
http://www.microsoft.com/technet/security/bulletin/ms07-034.mspx

Deep Links
Links available to Secunia VIM customers