PerthNorg

1points Posted 830 days, 19 hours ago by sandi

MS have commented on the following vulnerability:

IE 7 Internet Explorer 7 "mhtml:" Redirection Information Disclosure http://secunia.com/advisories/22477/

I know some will say that the following is nit-picking, but the fact is...

http://blogs.technet.com/msrc/archive/2006/10/19/information-on-reports-of-ie-7-vulnerability.aspx

"These reports are technically inaccurate: the issue concerned in these reports is not in Internet Explorer 7 (or any other version) at all. Rather, it is in a different Windows component, specifically a component in Outlook Express. While these reports use Internet Explorer as a vector the vulnerability itself is in Outlook Express."

Also, the vulnerability is not reproducible on Windows Vista.

The IE team also comments saying pretty much the same thing:

http://blogs.msdn.com/ie/archive/2006/10/19/an-ie7-security-vulnerability.aspx

This is something happens quite regularly, where a vulnerability is described as being an IE vulnerability when in fact it is not IE bits that are vulnerable but rather IE is being used as a jumping off point to access the vulnerable component.