Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email firstname.lastname@example.org
From: Tim Starling (tstarlingwikimedia.org)
Date: Sun May 23 2010 - 19:52:18 CDT
Internet Explorer is vulnerable to a drive-by arbitrary UNC file read,
with the usual consequences (local account password disclosure, etc.) as
in IE6 before SP1. It is in ICMFilter, which is accessible via the CSS
filter property. Sample exploit code:
IE attempts to contact the remote server when the element is scrolled
into view. The consequences of this are discussed in the context of
previous vulnerabilities at:
I have not checked the ICM file parser for further escalation, but I
think that the risk of disclosure of weak local passwords is sufficient
to warrant concern.
I contacted Microsoft and someone named Tony informed me that it's a
bug, not a security vulnerability, whatever that means.
-- Tim Starling