Microsoft Windows contains a flaw that allows a remote cross-site scripting (XSS) attack. This flaw exists because the MHTML protocol handler does not properly interpret MIME-formatted requests for content blocks. This may allow a user to create a specially crafted URL that would execute arbitrary script code in a user's browser within the trust relationship between their browser and the server.

Microsoft has released a patch to address this vulnerability. Additionally, it is possible to temporarily work around the flaw by implementing the following workaround: Enable the MHTML protocol lockdown. Consult the vendor advisory for more details.

• Security Tracker: 1025003
• Exploit Database: 16071
• CVE ID: 2011-0096 (see also: NVD)
• Microsoft Knowledge Base Article: 2503658
• CERT VU: 326549
• Secunia Advisory ID: 43093
• Bugtraq ID: 46055
• ISS X-Force ID: 65000
• OVAL ID: 6956
• VUPEN Advisory: ADV-2011-0242
• Vendor Specific News/Changelog Entry: http://blogs.technet.com/b/msrc/archive/2011/01/28/microsoft-releases-security-advisory-2501696.aspx
  http://blogs.technet.com/b/srd/archive/2011/01/28/more-information-about-the-mhtml-script-injection-vulnerability.aspx
  http://www.microsoft.com/technet/security/advisory/2501696.mspx
• Other Advisory URL: http://www.80vul.com/webzine_0x05/0x05%20IE%E4%B8%8BMHTML%E5%8D%8F%E8%AE%AE%E5%B8%A6%E6%9D%A5%E7%9A%84%E8%B7%A8%E5%9F%9F%E5%8D%B1%E5%AE%B3.html
• Vendor Specific Advisory URL: http://www.microsoft.com/technet/security/advisory/2501696.mspx
• News Article: http://www.scmagazineus.com/microsoft-distributes-17-patches-for-64-flaws/article/200597/
  http://www.thetechherald.com/article.php/201111/6926/MHTML-vulnerability-hit-by-targeted-attacks
• Microsoft Security Bulletin: MS11-026
• CERT: TA11-102A

• d4rkwind - Baidu