A vulnerability has been reported in Microsoft Windows Search, which can be exploited by malicious people to disclose sensitive information.

The vulnerability is caused due to the application improperly restricting the execution environment of a script when generating file previews. This can be exploited to run arbitrary HTML script code and disclose sensitive data from the local system when a specially crafted file is returned as a search result and previewed.

Solution
Apply patches.
Further details available to Secunia VIM customers

Provided and/or discovered by
The vendor credits Yair Amit of IBM Rational Application Security.

Original Advisory
Microsoft (KB963093):
http://www.microsoft.com/technet/security/Bulletin/MS09-023.mspx

Deep Links
Links available to Secunia VIM customers