# MA-265.012011: MyCERT Alert - Critical Vulnerability in Microsoft Windows

**Date:** 01 Feb 2011  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-265.012011  
**Advisory ID:** MA-265.012011

---

1.0 Introduction
A critical vulnerability (CVE-2011-0096) has been identified in the MHTML (MIME Encapsulation of Aggregate HTML). The vulnerability, if successfully exploited will cause the application to execution of arbitrary attacker-supplied script code in the context of Internet Explorer. This may allow the attacker to obtain sensitive information, spoof content, or perform arbitrary actions on a targeted website in the context of the victim. [1]
The vulnerability exists because of an error in the way MHTML (MIME Encapsulation of Aggregate HTML) interprets MIME-formatted requests for content blocks within a document, which could allow attackers to inject a client-side script in the response of a web request run in the context of Internet Explorer by tricking a user into following a specially crafted "MHTML:" link. [2]
2.0 Impact
An attacker who successfully exploits this vulnerability will be able to execution of arbitrary attacker-supplied script code in the context of Internet Explorer. This may allow the attacker to obtain sensitive information, spoof content, or perform arbitrary actions on a targeted website in the context of the victim. [3]
3.0 Affected Products
The detail list of the vulnerable products and versions are as below:
- Windows XP Service Pack 3
- Windows XP Professional x64 Edition Service Pack 2
- Windows Server 2003 Service Pack 2
- Windows Server 2003 x64 Edition Service Pack 2
- Windows Server 2003 with SP2 for Itanium-based Systems
- Windows Vista Service Pack 1 and Windows Vista Service Pack 2
- Windows Vista x64 Edition Service Pack 1 and Windows Vista x64 Edition Service Pack 2
- Windows Server 2008 for 32-bit Systems and Windows Server 2008 for 32-bit Systems Service Pack 2
- Windows Server 2008 for x64-based Systems and Windows Server 2008 for x64-based Systems Service Pack 2
- Windows Server 2008 for Itanium-based Systems and Windows Server 2008 for Itanium-based Systems Service Pack 2
- Windows 7 for 32-bit Systems
- Windows 7 for x64-based Systems
- Windows Server 2008 R2 for x64-based Systems
- Windows Server 2008 R2 for Itanium-based Systems
However, Server Core installation for Windows Server 2008 are not affected
4.0 Recommendations
4.1    Enable the MHTML protocol lockdown
Users are recommended to use the fixit solution provided by Microsoft. The FixIt is available here:
http://support.microsoft.com/kb/2501696
However, if users want to apply it manually, you can refer to the following article:
http://www.microsoft.com/technet/security/advisory/2501696.mspx#EIH
MyCERT would like to advise the users of Microsoft Windows to be vigilant of the latest security announcements by Microsoft and ensure that their operating systems are automatically updated. The article on how to enable the auto update feature in Microsoft is available at the following URL:
https://www.mycert.org.my/portal/articles-content?menu=b9f3fdda-c343-4cb4-99a7-a7506cfb13ba&id=62275f48-f209-4440-af1a-c5425c875fa4
Users may also consider using a vulnerability management tool such as Secunia to ensure that all applications are updated:
http://secunia.com/vulnerability\_scanning/personal/
MyCERT can be reached through the following channels for further assistance:
E-mail : [[email protected]](/cdn-cgi/l/email-protection)
Phone : 1-300-88-2999 (monitored during business hours)
Fax : +603 89453442
Handphone : +60 19 2665850 (24x7 call incident reporting)
SMS : CYBER999 REPORT <EMAIL> <COMPLAINT> to 15888
Business Hours : Mon - Fri 08:30 -17:30 MYT
Web: https://www.mycert.org.my
5.0 References
- http://www.microsoft.com/technet/security/advisory/2501696.mspx
- http://www.vupen.com/english/advisories/2011/0242
- http://www.securityfocus.com/bid/46055/