Microsoft Internet Explorer ActiveX / Security Bypass
Upon opening a specially crafted .MHT file on disk, Internet Explorer ActiveX control warnings as well as popup blocker privacy settings are not enforced. This can allow the execution of ActiveX content with zero warning to an unsuspecting end user and or force them to visit arbitrary attacker controlled websites.
By default when opening browser associated files that contain active content, MSIE restricts scripts from running without explicit user interaction and permission. Instead end users are presented with a yellow warning bar on the browsers webpage, asking first if they wish to allow the running of blocked content. This prevents execution of active content scripts or controls without the user first clicking the "Allow blocked content" warning bar.
Interestingly, specially crafted MHT files residing on disk that contain an invalid header directive suppress ActiveX warnings and Popup blocker privacy settings.
http://hyp3rlinx.altervista.org/advis...