Microsoft Internet Explorer 6.0 Outlook 2002 and Outlook 2003 allow remote attackers to cause a denial of service (CPU consumption) if \Do not save encrypted pages to disk\ is disabled via a web site or HTML e-mail that contains two null characters (%00) after the host name.