[原文]A function in Internet Explorer 5.0 through 5.5 does not properly verify the domain of a frame within a browser window, which allows a remote attacker to read client files, aka a new variant of the "Frame Domain Verification" vulnerability.
Microsoft IE Frame Domain Validation Arbitrary File Access
Remote / Network Access
Loss of Confidentiality
Microsoft Internet Explorer contains a flaw that may lead to an unauthorized information disclosure. The problem is due to improper enforcement of frames separation in the same window residing in different domains, which could allow a malicious Web site operator to open a frame in his own domain and a frame that refers to the visiting victim's file system. It is possible to view arbitrary files on a visiting victim's computer if the remote attacker knows or can guess the name and location of the file and if the file can be displayed in a Web browser window resulting in a loss of confidentiality.
Currently, there are no known workarounds or upgrades to correct this issue. However, Microsoft has released a patch to address this vulnerability.