Secunia

A vulnerability has been reported in Internet Explorer for Windows Server 2003, which can be exploited by malicious people to open arbitrary, known files on a user's system.

The vulnerability is caused due to an input validation error. This can be exploited to open arbitrary, known files outside of "Shell Folders" directories by constructing a link, which uses the "shell:" URI handler and contains the "\.." character sequence.

Example:
<a href="shell:cache\..\..\Local Settings\existing_file.html">

Successful exploitation allows opening arbitrary, known files on a user's system (including files associated with the user profile without having to guess the username).

This vulnerability is not considered critical in itself. However, it may pose a threat if combined with vulnerabilities that can be exploited to place malicious files on a user's system.

Solution
Apply Windows Server 2003 Service Pack 1.
Further details available in Customer Area

Provided and/or discovered by
Eiji James Yoshida

Changelog
Further details available in Customer Area

Original Advisory
Microsoft Windows Server 2003 "Shell Folders" Directory Traversal Vulnerability:
http://www.geocities.co.jp/SiliconValley/1667/advisory08e.html

Other references
Further details available in Customer Area

Deep Links
Links available in Customer Area