The MHTML protocol handler in Microsoft Outlook Express 6 and Windows Mail in Windows Vista does not properly handle Content-Disposition "notifications," which allows remote attackers to obtain sensitive information from other Internet Explorer domains, aka "Content Disposition Parsing Cross Domain Information Disclosure Vulnerability."

Arbitrary code can be executed on the remote host through the email client.  The remote host is running a version of Microsoft Outlook Express that contains several security flaws that may allow an attacker to execute arbitrary code on the remote host.  To exploit this flaw, an attacker would need to send a malformed email to a victim on the remote host and have him open it.

The remote host is running a version of Microsoft Outlook Express with several security flaws that could allow an attacker to execute arbitrary code on the remote host.

To exploit this flaw, an attacker would need to send a malformed email to a victim on the remote host and have him open it.

ID	Name	Product	Family	Severity
4093	Cumulative Security Update for Microsoft Outlook Express and Windows Mail (929123)	Nessus Network Monitor	SMTP Clients	medium
4092	Cumulative Security Update for Microsoft Outlook Express and Windows Mail (929123)	Nessus Network Monitor	SMTP Clients	medium
4090	Cumulative Security Update for Microsoft Outlook Express and Windows Mail (929123)	Nessus Network Monitor	SMTP Clients	medium
4088	Cumulative Security Update for Microsoft Outlook Express and Windows Mail (929123)	Nessus Network Monitor	SMTP Clients	medium
25487	MS07-034: Cumulative Security Update for Outlook Express and Windows Mail (929123)	Nessus	Windows : Microsoft Bulletins	high

Detections

Analytics

CVE-2007-2227

medium

Tenable Plugins

medium

medium

medium

medium

high