If a user is using a version of Internet Explorer that is not running in Protected Mode an attacker may be able to access files with an already known filename and location.

The vulnerability exists due to content being forced to render incorrectly from local files in such a way that information can be exposed to malicious Web sites. An attacker could host a specially crafted Web site that is designed to exploit this vulnerability through Internet Explorer and then convince a user to view the Web site. The attacker could also take advantage of compromised Web sites and Web sites that accept or host user-provided content or advertisements.

Affected Versions:
Internet Explorer 5.01 Service Pack 4
Internet Explorer 6 Service Pack 1
Internet Explorer 7
Internet Explorer 8

Protected Mode prevents exploitation of this vulnerability and is running by default for versions of Internet Explorer on Windows Vista, Windows Server 2008, Windows 7, and Windows Server 2008.

2) Configure Internet Explorer to prompt before running Active Scripting or to disable Active Scripting in the Internet and Local intranet security zone

Impact of workaround #1 and #2: On visiting Web sites on the Internet or Intranet that use ActiveX or Active Scripting to provide additional functionality, you will be prompted frequently when you enable this workaround.

3) Enable Internet Explorer Network Protocol Lockdown for Windows XP. Microsoft is providing a Microsoft Fix it solution to enable or disable this workaround. Refer to KB980088 for the Fix it solution.

Impact of workaround #3: HTML content from UNC paths in the Internet / Local Intranet / Restricted zones will no longer automatically run script or ActiveX controls.

Detailed steps on applying the workarounds can be found at Microsoft Security Advisory (980088).

Patch:
There are no vendor-supplied patches available at this time. Refer to Microsoft Security Advisory (980088) to obtain additional details about the vulnerability.