I wanted to take a minute and take a quick look at MS08-050. This was the recently released Microsoft Security Bulletin fixing a vulnerability in Windows Messenger. What I don't get is the Maximum Severity Impact of 'Information Disclosure'. From the Microsoft Advisory:

Scripting of a particular ActiveX control, Messenger.UIAutomation.1, could allow information disclosure from these programs in the context of the logged-on user. An attacker could change state, get contact information, and initiate audio and video chat sessions without the knowledge of the logged-on user. An attacker could also capture the user’s logon ID and remotely log on to the user’s Messenger client as that user.

Now, maybe I'm missing something here but since when is something that is interactive solely information disclosure? If I can change state, initiate audio and video sessions and log on to the user's client... I'd say that's a little more than 'Information Disclosure'. Given that most XP users will have this installed (given that it ships with the operating system), I would think this becomes slightly more important than an 'Information Disclosure'.

Does anyone have any insight on how Microsoft selects these ratings? I would really like to know the thought process that lead to this being labeled 'Information Disclosure'.