SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Web Browser)  >   Microsoft Internet Explorer Vendors:   Microsoft
Microsoft Internet Explorer Bug in Using HTTPS Proxies May Disclose Web URLs to Remote Users
SecurityTracker Alert ID:  1015350
SecurityTracker URL:  http://securitytracker.com/id/1015350
CVE Reference:   CVE-2005-2830   (Links to External Site)
Date:  Dec 13 2005
Impact:   Disclosure of user information
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): 5.01 SP4, 5.5 SP2, 6 SP1; and prior service packs
Description:   A vulnerability was reported in Microsoft Internet Explorer when using an HTTPS proxy server. Web addresses may be incorrectly transmitted in clear text.

When the target user's browser uses an HTTPS proxy server and HTTP Basic authentication, Internet Explorer may send a URL in clear text even though the connection to the proxy server is an HTTPS connection.

A remote user that can monitor the network between the target user and the proxy server can read the URL.

Microsoft indicates that this vulnerability has been publicly disclosed.

Impact:   A remote user that can monitor the network may be able to read URLs sent from the browser to the proxy server.
Solution:   The vendor has issued the following fixes:

Internet Explorer 5.01 Service Pack 4 on Microsoft Windows 2000 Service Pack 4:

http://www.microsoft.com/downloads/details.aspx?FamilyId=4005B74A-D6E6-4A32-A3B1-276686B4A428

Internet Explorer 6 Service Pack 1 on Microsoft Windows 2000 Service Pack 4 or on Microsoft Windows XP Service Pack 1:

http://www.microsoft.com/downloads/details.aspx?FamilyId=A8443CD2-D98D-427B-9F0E-BD7E19FCB994

Internet Explorer 6 for Microsoft Windows XP Service Pack 2:

http://www.microsoft.com/downloads/details.aspx?FamilyId=E4B5BA57-D4F2-4798-9154-2869E371C9D1

Internet Explorer 6 for Microsoft Windows Server 2003 and Microsoft Windows Server 2003 Service Pack 1:

http://www.microsoft.com/downloads/details.aspx?FamilyId=9D70FB20-C7C9-43AF-A864-6DBC9A542CC6

Internet Explorer 6 for Microsoft Windows Server 2003 for Itanium-based Systems and Microsoft Windows Server 2003 with SP1 for Itanium-based Systems:

http://www.microsoft.com/downloads/details.aspx?FamilyId=1EE790B9-E596-4344-AEC3-FCB3289D7E9C

Internet Explorer 6 for Microsoft Windows Server 2003 x64 Edition:

http://www.microsoft.com/downloads/details.aspx?FamilyId=8E9C23E5-7988-42DA-A8BD-2C1A534BF995

Internet Explorer 6 for Microsoft Windows XP Professional x64 Edition:

http://www.microsoft.com/downloads/details.aspx?FamilyId=E1652B4A-6339-4B31-8ACF-D2A844C24F70

A restart is required.

This cumulative update supercedes the update provided in MS05-052.

Vendor URL:  www.microsoft.com/technet/security/Bulletin/MS05-054.mspx (Links to External Site)
Cause:   Access control error, State error
Underlying OS:  Windows (98), Windows (2000), Windows (2003), Windows (XP)

Message History:   None.


 Source Message Contents



[Original Message Not Available for Viewing]


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2020, SecurityGlobal.net LLC