[NT] Internet Explorer Handling of %20 Allows Spoofing

From: SecuriTeam (support_at_securiteam.com)
Date: 01/17/05

  • Next message: SecuriTeam: "[NEWS] AWStats Remote Command Execution Vulnerability (configdir)" 
    To: list@securiteam.com
Date: 17 Jan 2005 14:19:35 +0200

    The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
    - - promotion

    The SecuriTeam alerts list - Free, Accurate, Independent.

    Get your security news from a reliable source.
    http://www.securiteam.com/mailinglist.html

    - - - - - - - - -

      Internet Explorer Handling of %20 Allows Spoofing
    ------------------------------------------------------------------------

    SUMMARY

    Internet Explorer supports two forms of URI (Universal Resource
    Identifiers), a full qualified domain name and dotted IP. Whenever
    Internet Explorer receives the dotted IP form, it will ignore any
    characters written after an escape space sign (%20). This opens the user
    to attack has he can be tricked into thinking he is connecting a certain
    server while in fact he is connected to another.

    DETAILS

    Vulnerable Systems:
     * Internet Explorer version 6.0 SP1
     * Internet Explorer version 6.0 SP2
     * Internet Explorer version 5.0
     * Internet Explorer version 5.5

    Apparently IE handles IPs in URLs as something like (as you might expect):
     http://xxx.xxx.xxx.xxx/

    But the problem is if you put a %20 in the IP address like this, it will
    still render (assuming I am under 16 charachters between the slashes):
     http://x.x.x.x%20/

    It is looking for 16 charachters and ignores anything after the %20
    (space). This becomes a problem is in the case of a short URL you can put
    in some data here, like so:
     http://x.x.x.x%20a.com/

    Further, if the real IP address is on a server that can handle this (IIS
    doesn't know how to handle it in all the cases I have tested, but Apache
    handles it fine by default) and you have either Earthlink's
    FraudEliminator or CoreStreet's SpooofStick, they give incorrect
    information. (Please don't hit this poor guy's IP, he just happened to
    have one short enough to test this):
     <http://www.shocking.com/~rsnake/images/rs/percenttwenty.jpg>
    http://www.shocking.com/~rsnake/images/rs/percenttwenty.jpg

    ADDITIONAL INFORMATION

    The information has been provided by <mailto:rsnake@shocking.com> RSnake.

    ========================================

    This bulletin is sent to members of the SecuriTeam mailing list.
    To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
    In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

    ====================
    ====================

    DISCLAIMER:
    The information in this bulletin is provided "AS IS" without warranty of any kind.
    In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

  • Next message: SecuriTeam: "[NEWS] AWStats Remote Command Execution Vulnerability (configdir)"

    Relevant Pages

    • [NT] Comodo DLL Injection via Weak Hash Function Exploitation Vulnerability
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Comodo DLL Injection via Weak Hash Function Exploitation Vulnerability ... register unsigned long crc; ... This program assumes that Internet Explorer is a privileged application ...
      (Securiteam)
    • [NT] Multiple Vulnerabilities in Internet Explorer (Heap Corruption, Race Condition)
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... The heap corruption and race condition in Internet Explorer allow ... * Windows XP Professional with Service Pack 2 ... Pack 3, on Microsoft Windows 2000 Service Pack 4, or on Microsoft Windows ...
      (Securiteam)
    • [NT] Microsoft Internet Explorer Multiple Vulnerabilities (Content-Disposition, codebase)
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Internet Explorer, which can be exploited by malicious people to disclose ... The vulnerability of "Content-Disposition" is caused due to insufficient ... in context of the "Temporary Internet Files" folder when a user clicks on ...
      (Securiteam)
    • [NT] Microsoft Internet Explorer JavaScript setExpression Heap Corruption Vulnerability
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Internet Explorer is "a graphical web browser developed by Microsoft Corp. ... vulnerability in Microsoft Corp.'s Internet Explorer web browser allows ...
      (Securiteam)
    • [NT] Internet Explorer Memory Corruption Bug
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Internet Explorer is Microsoft's core browser that is a part of any ... As a result of this invalid CSS tag the browser's ... The vulnerability allows a malicious web page to crash Internet Explorer ...
      (Securiteam)