CVE ID:	CVE-2008-1448
Description:	The MHTML protocol handler in a component of Microsoft Outlook Express 5.5 SP2 and 6 through SP1, and Windows Mail, does not assign the correct Internet Explorer Security Zone to UNC share pathnames, which allows remote attackers to bypass intended access restrictions and read arbitrary files via an mhtml: URI in conjunction with a redirection, aka "URL Parsing Cross-Domain Information Disclosure Vulnerability."
Test IDs:	1.3.6.1.4.1.25623.1.0.900031
Cross References:	Common Vulnerability Exposure (CVE) ID: CVE-2008-1448 BugTraq ID: 30585 http://www.securityfocus.com/bid/30585 Bugtraq: 20080813 CORE-2008-0103: Internet Explorer Zone Elevation Restrictions Bypass and Security Zone Restrictions Bypass (Google Search) http://www.securityfocus.com/archive/1/495458/100/0/threaded Cert/CC Advisory: TA08-225A http://www.us-cert.gov/cas/techalerts/TA08-225A.html HPdes Security Advisory: HPSBST02360 http://marc.info/?l=bugtraq&m=121915960406986&w=2 HPdes Security Advisory: SSRT080117 http://marc.info/?l=bugtraq&m=121915960406986&w=2 http://www.coresecurity.com/content/internet-explorer-zone-elevation Microsoft Security Bulletin: MS08-048 https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-048 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5886 http://www.securitytracker.com/id?1020679 http://www.securitytracker.com/id?1020680 http://secunia.com/advisories/31415 http://www.vupen.com/english/advisories/2008/2352