Microsoft IE Plug-in Navigation Flaw Lets Remote Users Spoof URLs in the Addresses Bar
|
|
SecurityTracker Alert ID: 1011644
|
|
SecurityTracker URL: http://securitytracker.com/id?1011644
|
|
CVE Reference: CAN-2004-0843
(Links to External Site)
|
Date: Oct 12 2004
|
Impact: Modification of system information
|
Fix Available: Yes
Vendor Confirmed: Yes
|
Version(s): 5.5, 6
|
Description: A vulnerability was reported in Microsoft Internet Explorer (IE) in the processing of plug-in navigations. A remote user can cause an arbitrary URL to be listed in the address bar.
Microsoft reported that a remote user can create HTML code that will invoke a plug-in and cause IE to display an arbitrary URL in
the address bar while displaying a different web site in the browser window.
A remote user can exploit this to spoof web sites.
|
Impact: A remote user can cause an arbitrary URL to be listed in the address bar.
|
Solution: The vendor has issued a fix.
Internet Explorer 5.01 Service Pack 3 on Windows 2000 SP3:
http://www.microsoft.com/downloads/details.aspx?FamilyId=2D8E8E97-4946-4994-9
24B-1FB1DC1881BA&displaylang=en
Internet Explorer 5.01 Service Pack 4 on Windows 2000 SP4:
http://www.microsoft.com/downloads/details.aspx?FamilyId=72DBE239-AF0A-
42B5-B88C-A00371F6EC81&displaylang=en
Internet Explorer 5.5 Service Pack 2 on Microsoft Windows Me:
http://www.microsoft.com/downloads/details.aspx?FamilyId=BE27F
77C-3C2D-45F1-86DF-2B71799DA169&displaylang=en
Internet Explorer 6 on Windows XP:
http://www.microsoft.com/downloads/details.aspx?FamilyId=A89CFBE8-C299-415D-A9D6
-7CC6429C547D&displaylang=en
Internet Explorer 6 Service Pack 1 on Microsoft Windows 2000 Service Pack 3, on Microsoft Windows
2000 Service Pack 4, on Microsoft Windows XP, or on Microsoft Windows XP Service Pack 1:
http://www.microsoft.com/downloads/details.aspx?FamilyId=7C1404E6-F5D4-4FED-95
73-DD83F2DFF074&displaylang=en
Internet Explorer 6 Service Pack 1 on Microsoft Windows NT Server 4.0 Service Pack 6a, on Microsoft
Windows NT Server 4.0 Terminal Service Edition Service Pack 6, on Microsoft Windows 98, on Microsoft Windows 98 SE, or on Microsoft
Windows Me:
http://www.microsoft.com/downloads/details.aspx?FamilyId=DE8D94C4-7F58-4CE7-B8BD-51CFD795B03E&displaylang=en
Internet
Explorer 6 for Windows XP Service Pack 1 (64-Bit Edition):
http://www.microsoft.com/downloads/details.aspx?FamilyId=C05103E8-4402-4D54-BA03-FBBC24142E4D&displaylang=en
Internet Explorer 6 for Windows Server 2003:
http://www.microsoft.com/downloads/details.aspx?FamilyId=19E69E5F-9C98-49AD-A61F-4F82A4014412&displaylang=en
In
ternet Explorer 6 for Windows Server 2003 64-Bit Edition and Windows XP 64-Bit Edition Version 2003:
http://www.microsoft.com/downloads/details.aspx?FamilyId=566C2A05-
2513-4E30-A3EA-87D4BF7F9730&displaylang=en
Internet Explorer 6 for Windows XP Service Pack 2:
http://www.microsoft.com/downloads/details.aspx?FamilyId=CF47B515-3F
51-43E1-9246-2C2264C49E2E&displaylang=en
These patches require a system restart.
|
Vendor URL: www.microsoft.com/technet/security/bulletin/ms04-038.mspx (Links to External Site)
|
Cause: State error
|
Underlying OS: Windows (Any)
|
|
Message History:
None.
|
Source Message Contents
|
Date: Tue, 12 Oct 2004 15:10:33 -0400
Subject: http://www.microsoft.com/technet/security/bulletin/ms04-038.mspx
|
MS04-038
http://www.microsoft.com/technet/security/bulletin/ms04-038.mspx
|
|
