CVE-2004-0380 in Internet Explorer
Summary
by MITRE
The MHTML protocol handler in Microsoft Outlook Express 5.5 SP2 through Outlook Express 6 SP1 allows remote attackers to bypass domain restrictions and execute arbitrary code, as demonstrated on Internet Explorer using script in a compiled help (CHM) file that references the InfoTech Storage (ITS) protocol handlers such as (1) ms-its, (2) ms-itss, (3) its, or (4) mk:@MSITStore, aka the "MHTML URL Processing Vulnerability."
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/15/2025
The CVE-2004-0380 vulnerability represents a critical security flaw in Microsoft Outlook Express that exploited the MHTML protocol handler to bypass domain restrictions and execute arbitrary code. This vulnerability specifically affected Outlook Express versions 5.5 SP2 through 6 SP1, creating a significant attack surface that adversaries could leverage to compromise systems. The flaw emerged from the improper handling of MHTML URLs within the email client, particularly when processing content that referenced InfoTech Storage (ITS) protocol handlers including ms-its, ms-itss, its, and mk:@MSITStore protocols. These protocols were designed to handle compiled help files and internal storage mechanisms but became vectors for malicious code execution when improperly validated by Outlook Express.
The technical exploitation of this vulnerability occurred through the manipulation of MHTML URLs that referenced ITS protocol handlers, allowing attackers to craft malicious email content that would trigger code execution when processed by the vulnerable email client. When Outlook Express encountered these specially crafted URLs in email messages, the protocol handlers would attempt to process the referenced content without proper validation, leading to arbitrary code execution on the victim's system. This vulnerability was particularly dangerous because it could be triggered simply by viewing an email message containing the malicious MHTML content, requiring no special user interaction beyond opening the message. The attack vector exploited the trust relationship between Outlook Express and ITS protocol handlers, leveraging the legitimate functionality to execute malicious payloads.
The operational impact of CVE-2004-0380 was substantial, as it enabled attackers to gain unauthorized code execution privileges on vulnerable systems without requiring user interaction beyond opening an email. This vulnerability was classified under CWE-122 as a buffer overflow condition and aligned with ATT&CK technique T1203 for Exploitation for Client Execution, making it a prime target for phishing campaigns and targeted attacks. The vulnerability affected organizations using Outlook Express as their primary email client, particularly those with older systems that had not received the necessary security updates. The exploitation could result in complete system compromise, allowing attackers to install malware, steal sensitive information, or establish persistent access to affected systems. Organizations with email systems that processed MHTML content were particularly vulnerable, as the attack could be delivered through seemingly legitimate email communications.
Mitigation strategies for CVE-2004-0380 focused on patch management and protocol restriction measures. Microsoft released security updates that addressed the vulnerability by modifying the MHTML protocol handler to properly validate URLs and restrict access to potentially dangerous ITS protocol handlers. Organizations should have implemented immediate patch deployment to all affected Outlook Express installations, with particular attention to legacy systems that might not have received automatic updates. Additional mitigations included disabling MHTML processing in email clients, implementing strict email content filtering policies, and educating users about the dangers of opening suspicious email attachments or messages containing unknown URLs. Network administrators were advised to monitor for suspicious email traffic patterns and implement email security solutions that could detect and block malicious MHTML content. The vulnerability highlighted the importance of secure protocol handling and proper input validation in email client applications, leading to enhanced security practices in subsequent software development cycles and emphasizing the need for regular security updates to protect against known vulnerabilities.