Re: New URL spoofing bug in Microsoft Internet Explorer

From: Russ (Russ.Cooper_at_RC.ON.CA)
Date: 10/29/04

  • Next message: James C Slora Jr: "Re: New URL spoofing bug in Microsoft Internet Explorer" 
    Date:         Fri, 29 Oct 2004 16:19:03 -0400
To: NTBUGTRAQ@LISTSERV.NTBUGTRAQ.COM

    Firstly, the way the HTML is written, the href which should display and be used is http://www.microsoft.com, the single </a> should be the closing element for the first href.

    Secondly, on XP SP2 this doesn't work. First, you get an information bar warning that content has been blocked. If you mouseover the "Click Here", you see www.google.com, not microsoft, in the status bar.

    Thirdly, if you allow the blocked content, nothing changes except that one linefeed is introduced on the page and the "Click Here" is one line lower. An interesting side-effect of allowing the content is that while a mouseover the "Click Here" reveals www.google.com, if you slowly move the mouse down you will see www.microsoft.com flash in the status bar.

    Seems to me we still have the idiotic rendering of incomplete/incorrect HTML, the way it does in Outlook. Forget about tags and it will render anything that looks like a URL as a URL.

    In isolation, the google href may appear to be the most well-formed, but since HTML shouldn't be treated as isolated data islands, but instead as a sequence from beginning to end, the fact that XP SP2 renders www.google.com as the link is just wrong (even if it does mean the spoofing attempt fails.)

    Further, if the single </a> tag closes the google href, then how is it possible that IE still can put www.microsoft.com in the status bar at all? It has no closing tag, so is not well-formed, and shouldn't be treated as a valid tag...but IE, even of XP SP2, still thinks its valid (granted, after the blocked content has been allowed.) What possible reason would there be to allow the rendering of that href???

    All works as advertised on non-XP SP2 IE installations.

    Cheers,
    Russ - Senior Scientist/NTBugtraq Editor
    TruSecure Corporation 

    --
NTBugtraq Editor's Note:
Want to reply to the person who sent this message? This list is configured such that just hitting reply is going to result in the message coming to the list, not to the individual who sent the message. This was done to help reduce the number of Out of Office messages posters received. So if you want to send a reply just to the poster, you'll have to copy their email address out of the message and place it in your TO: field.
--
  • Next message: James C Slora Jr: "Re: New URL spoofing bug in Microsoft Internet Explorer"

    Relevant Pages

    • Ive become a hard-core userContent.CSS junkie !
      ... html, html * { ... display: inline!important;} ... Some of the schools have software developers... ... documenting the Source Code is different from documenting the app. ...
      (sci.physics)
    • Re: Redirecting between PHP Pages
      ... but at the very least in a php script. ... > on the outcome of the validation, you want to do one of two things: ... with the various bits of HTML being ... Display login form ...
      (comp.lang.php)
    • Re: formating text retrieved from a db
      ... You had to add HTML ... > If you were to display a phrase in your browser in simple HTML, ... They have a lofty name, ... has the formating with blank lines between the paragraphs etc. there is no ...
      (comp.lang.php)
    • Re: Am I on the right track here?
      ... that happens to be HTML ... | display rectangle for each video in that 4x2 layout, ... | display HTML relative to each rectangle. ... Once the server hands the page to the browser, the server, ...
      (comp.lang.php)
    • Re: Displaying HTML from memory
      ... IIS is out of the questione and I still don'w want to save HTML ... > you can pass a memory stream. ... > web page, you want to display, as a parameter. ... > read the stream and flush its contents to the HttpRespond.Output stream. ...
      (microsoft.public.dotnet.languages.csharp)