[NT] Internet Explorer Handling of %20 Allows Spoofing

• Previous message: SecuriTeam: "[UNIX] SGallery Multiple Vulnerabilities (SQL Injection, Path Disclosure, File Inclusion)"
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]

To: list@securiteam.com
Date: 17 Jan 2005 14:19:35 +0200

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html

- - - - - - - - -

  Internet Explorer Handling of %20 Allows Spoofing
------------------------------------------------------------------------

SUMMARY

Internet Explorer supports two forms of URI (Universal Resource
Identifiers), a full qualified domain name and dotted IP. Whenever
Internet Explorer receives the dotted IP form, it will ignore any
characters written after an escape space sign (%20). This opens the user
to attack has he can be tricked into thinking he is connecting a certain
server while in fact he is connected to another.

DETAILS

Vulnerable Systems:
 * Internet Explorer version 6.0 SP1
 * Internet Explorer version 6.0 SP2
 * Internet Explorer version 5.0
 * Internet Explorer version 5.5

Apparently IE handles IPs in URLs as something like (as you might expect):
 http://xxx.xxx.xxx.xxx/

But the problem is if you put a %20 in the IP address like this, it will
still render (assuming I am under 16 charachters between the slashes):
 http://x.x.x.x%20/

It is looking for 16 charachters and ignores anything after the %20
(space). This becomes a problem is in the case of a short URL you can put
in some data here, like so:
 http://x.x.x.x%20a.com/

Further, if the real IP address is on a server that can handle this (IIS
doesn't know how to handle it in all the cases I have tested, but Apache
handles it fine by default) and you have either Earthlink's
FraudEliminator or CoreStreet's SpooofStick, they give incorrect
information. (Please don't hit this poor guy's IP, he just happened to
have one short enough to test this):
 <http://www.shocking.com/~rsnake/images/rs/percenttwenty.jpg>
http://www.shocking.com/~rsnake/images/rs/percenttwenty.jpg

ADDITIONAL INFORMATION

The information has been provided by <mailto:rsnake@shocking.com> RSnake.

========================================

This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

====================
====================

DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

• Previous message: SecuriTeam: "[UNIX] SGallery Multiple Vulnerabilities (SQL Injection, Path Disclosure, File Inclusion)"
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]

Relevant Pages

• [NT] Comodo DLL Injection via Weak Hash Function Exploitation Vulnerability
  ... The following security advisory is sent to the securiteam mailing list, and can be
  found at the SecuriTeam web site: http://www.securiteam.com ... Comodo DLL Injection via
  Weak Hash Function Exploitation Vulnerability ... register unsigned long crc; ...
  This program assumes that Internet Explorer is a privileged application ... (Securiteam)
• [NT] Multiple Vulnerabilities in Internet Explorer (Heap Corruption, Race Condition)
  ... The following security advisory is sent to the securiteam mailing list, and can be
  found at the SecuriTeam web site: http://www.securiteam.com ... The heap corruption and race condition
  in Internet Explorer allow ... * Windows XP Professional with Service Pack 2 ...
  Pack 3, on Microsoft Windows 2000 Service Pack 4, or on Microsoft Windows ... (Securiteam)
• [NT] Microsoft Internet Explorer Multiple Vulnerabilities (Content-Disposition, codebase)
  ... The following security advisory is sent to the securiteam mailing list, and can be
  found at the SecuriTeam web site: http://www.securiteam.com ... Internet Explorer, which
  can be exploited by malicious people to disclose ... The vulnerability of "Content-Disposition"
  is caused due to insufficient ... in context of the "Temporary Internet Files" folder when
  a user clicks on ... (Securiteam)
• [NT] Microsoft Internet Explorer JavaScript setExpression Heap Corruption Vulnerability
  ... The following security advisory is sent to the securiteam mailing list, and can be
  found at the SecuriTeam web site: http://www.securiteam.com ... Internet Explorer is "a
  graphical web browser developed by Microsoft Corp. ... vulnerability in Microsoft
  Corp.'s Internet Explorer web browser allows ... (Securiteam)
• [NT] Internet Explorer Memory Corruption Bug
  ... The following security advisory is sent to the securiteam mailing list, and can be
  found at the SecuriTeam web site: http://www.securiteam.com ... Internet Explorer is Microsoft's
  core browser that is a part of any ... As a result of this invalid CSS tag the browser's
  ... The vulnerability allows a malicious web page to crash Internet Explorer ...
  (Securiteam)