Secunia

A vulnerability has been identified in Outlook Express, which can be exploited to bypass the file download security restriction.

It is possible to download a file in Outlook Express even though it has been configured to run in Internet Explorer's "Restricted Zone" and file downloads have been disabled.

The vulnerability can be exploited by constructing a special email. When viewed, the email will fetch an URL, which invokes a certain media file (eg. ".asf"). This will open Windows Media Player to play the media file. Script features in this can then open Internet Explorer and fetch an URL referencing a malicious file thereby circumventing the file download restriction.

NOTE: This vulnerability does not allow automatic download and execution of a file but presents the user with a download dialog box.

Solution
Uninstall Windows Media Player or upgrade to version 9.

Provided and/or discovered by
http-equiv

Other references
Further details available in Customer Area

Deep Links
Links available in Customer Area