Microsoft Internet Explorer Bug in Using HTTPS Proxies May Disclose Web URLs to Remote Users
|
|
SecurityTracker Alert ID: 1015350
|
|
SecurityTracker URL: http://securitytracker.com/id?1015350
|
|
CVE Reference: CVE-2005-2830
(Links to External Site)
|
Date: Dec 13 2005
|
Impact: Disclosure of user information
|
Fix Available: Yes
Vendor Confirmed: Yes
|
Advisory: Microsoft Security Bulletin
|
Version(s): 5.01 SP4, 5.5 SP2, 6 SP1; and prior service packs
|
Description: A vulnerability was reported in Microsoft Internet Explorer when using an HTTPS proxy server. Web addresses may be incorrectly transmitted in clear text.
When the target user's browser uses an HTTPS proxy server and HTTP Basic authentication, Internet Explorer may send a URL in clear
text even though the connection to the proxy server is an HTTPS connection.
A remote user that can monitor the network between
the target user and the proxy server can read the URL.
Microsoft indicates that this vulnerability has been publicly disclosed.
|
Impact: A remote user that can monitor the network may be able to read URLs sent from the browser to the proxy server.
|
Solution: The vendor has issued the following fixes:
Internet Explorer 5.01 Service Pack 4 on Microsoft Windows 2000 Service Pack 4:
http://www.microsoft.com/downloads/details
.aspx?FamilyId=4005B74A-D6E6-4A32-A3B1-276686B4A428
Internet Explorer 6 Service Pack 1 on Microsoft Windows 2000 Service Pack
4 or on Microsoft Windows XP Service Pack 1:
http://www.microsoft.com/downloads/details.aspx?FamilyId=A8443CD2-D98D-427B-9F0E-BD7E19FCB994
Internet
Explorer 6 for Microsoft Windows XP Service Pack 2:
http://www.microsoft.com/downloads/details.aspx?FamilyId=E4B5BA57-D4F2-4798-9154-2869E371C9D1
Internet
Explorer 6 for Microsoft Windows Server 2003 and Microsoft Windows Server 2003 Service Pack 1:
http://www.microsoft.com/downloads/details.aspx?FamilyId=9D70FB20-C7C9-4
3AF-A864-6DBC9A542CC6
Internet Explorer 6 for Microsoft Windows Server 2003 for Itanium-based Systems and Microsoft Windows Server
2003 with SP1 for Itanium-based Systems:
http://www.microsoft.com/downloads/details.aspx?FamilyId=1EE790B9-E596-4344-AEC3-FCB3289D7E9C
Internet
Explorer 6 for Microsoft Windows Server 2003 x64 Edition:
http://www.microsoft.com/downloads/details.aspx?FamilyId=8E9C23E5-7988-42DA-A8BD-2C1A534BF995
Internet
Explorer 6 for Microsoft Windows XP Professional x64 Edition:
http://www.microsoft.com/downloads/details.aspx?FamilyId=E1652B4A-6339-4B31-8ACF-D2A844C24F70
A
restart is required.
This cumulative update supercedes the update provided in MS05-052.
|
Vendor URL: www.microsoft.com/technet/security/Bulletin/MS05-054.mspx (Links to External Site)
|
Cause: Access control error, State error
|
Underlying OS: Windows (98), Windows (2000), Windows (2003), Windows (XP)
|
|
Message History:
None.
|
Source Message Contents
|
Date: Tue, 13 Dec 2005 13:40:43 -0500
Subject: MS05-054
|
http://www.microsoft.com/technet/security/Bulletin/MS05-054.mspx
|
|
