Microsoft Internet Explorer Address Bar CVE-2013-1451 URI Spoofing Vulnerability

Bugtraq ID:	57641
Class:	Design Error
CVE:	CVE-2013-1451
Remote:	Yes
Local:	No
Published:	Jan 29 2013 12:00AM
Updated:	Jan 30 2013 10:40PM
Credit:	Christian Haider
Vulnerable:	Microsoft Internet Explorer 9 + Microsoft Windows 7 + Microsoft Windows 7 for 32-bit Systems SP1 + Microsoft Windows 7 for 32-bit Systems 0 + Microsoft Windows 7 for x64-based Systems SP1 + Microsoft Windows 7 for x64-based Systems 0 + Microsoft Windows 7 Home Premium - Sp1 X64 + Microsoft Windows 7 Home Premium - Sp1 X32 + Microsoft Windows Server 2008 R2 + Microsoft Windows Server 2008 for 32-bit Systems SP2 + Microsoft Windows Server 2008 for 32-bit Systems 0 + Microsoft Windows Server 2008 for x64-based Systems SP2 + Microsoft Windows Server 2008 for x64-based Systems 0 + Microsoft Windows Server 2008 R2 for x64-based Systems SP1 + Microsoft Windows Vista SP2 + Microsoft Windows Vista SP1 + Microsoft Windows Vista x64 Edition SP2 + Microsoft Windows Vista x64 Edition SP1 + Microsoft Windows Vista x64 Edition 0 Microsoft Internet Explorer 8 + Microsoft Windows 7 + Microsoft Windows 7 for 32-bit Systems SP1 + Microsoft Windows 7 for 32-bit Systems 0 + Microsoft Windows 7 for x64-based Systems SP1 + Microsoft Windows 7 for x64-based Systems 0 + Microsoft Windows 7 Home Premium 0 + Microsoft Windows 7 Home Premium - Sp1 X64 + Microsoft Windows 7 Home Premium - Sp1 X32 + Microsoft Windows Server 2008 R2 + Microsoft Windows Server 2003 Sp2 X64 + Microsoft Windows Server 2003 SP2 + Microsoft Windows Server 2003 Sp1 X64 + Microsoft Windows Server 2003 SP1 + Microsoft Windows Server 2008 R2 SP1 + Microsoft Windows Server 2008 for x64-based Systems SP2 + Microsoft Windows Server 2008 R2 x64 SP1 + Microsoft Windows Server 2008 R2 x64 0 + Microsoft Windows Server 2008 Standard Edition X64 + Microsoft Windows Server 2008 Standard Edition SP2 + Microsoft Windows Server 2008 Standard Edition 0 + Microsoft Windows Server 2008 Standard Edition - Sp2 Web + Microsoft Windows Vista SP2 + Microsoft Windows Vista SP1 + Microsoft Windows Vista Home Premium SP2 + Microsoft Windows Vista Home Premium SP1 + Microsoft Windows Vista Home Premium + Microsoft Windows Vista Home Basic SP2 + Microsoft Windows Vista Home Basic SP1 + Microsoft Windows Vista Home Basic + Microsoft Windows Vista Enterprise SP2 + Microsoft Windows Vista Enterprise SP1 + Microsoft Windows Vista Enterprise + Microsoft Windows Vista Business SP2 + Microsoft Windows Vista Business SP1 + Microsoft Windows Vista 0 + Microsoft Windows Vista Business 64-bit edition SP2 + Microsoft Windows Vista Business 64-bit edition SP1 + Microsoft Windows Vista Business 64-bit edition 0 + Microsoft Windows Vista Enterprise 64-bit edition SP2 + Microsoft Windows Vista Enterprise 64-bit edition SP1 + Microsoft Windows Vista Enterprise 64-bit edition 0 + Microsoft Windows Vista Home Basic 64-bit edition Sp2 X64 + Microsoft Windows Vista Home Basic 64-bit edition SP2 + Microsoft Windows Vista Home Basic 64-bit edition SP1 + Microsoft Windows Vista Home Basic 64-bit edition 0 + Microsoft Windows Vista Home Premium 64-bit edition SP2 + Microsoft Windows Vista Home Premium 64-bit edition SP1 + Microsoft Windows Vista Home Premium 64-bit edition 0 + Microsoft Windows XP 0 + Microsoft Windows XP Embedded SP3 + Microsoft Windows XP Embedded SP2 + Microsoft Windows XP Embedded SP1 + Microsoft Windows XP Embedded + Microsoft Windows XP Home SP3 + Microsoft Windows XP Home SP2 + Microsoft Windows XP Home SP1 + Microsoft Windows XP Home + Microsoft Windows XP Media Center Edition SP3 + Microsoft Windows XP Media Center Edition SP2 + Microsoft Windows XP Media Center Edition SP1 + Microsoft Windows XP Professional SP3 + Microsoft Windows XP Professional SP2 + Microsoft Windows XP Professional SP1 + Microsoft Windows XP Professional + Microsoft Windows XP Professional x64 Edition SP2 + Microsoft Windows XP Professional x64 Edition
Not Vulnerable:

Microsoft Internet Explorer Address Bar CVE-2013-1451 URI Spoofing Vulnerability

Microsoft Internet Explorer is prone to a URI-spoofing spoofing vulnerability.

An attacker can display the contents of the spoofed site, that seemingly originate from the trusted site, to the user. This allows a remote attacker to carry out phishing attacks. Other attacks may be possible.

Microsoft Internet Explorer 8 and 9 are vulnerable.

Microsoft Internet Explorer Address Bar CVE-2013-1451 URI Spoofing Vulnerability

The researcher who discovered this issue has created a proof-of-concept. Please see the references for more information.

Microsoft Internet Explorer Address Bar CVE-2013-1451 URI Spoofing Vulnerability

Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Microsoft Internet Explorer Address Bar CVE-2013-1451 URI Spoofing Vulnerability

References:

• Microsoft Internet Explorer HomePage (Microsoft)