Internet Explorer Window Loading Race Condition Address Bar Spoofing
Secunia Advisory: SA19521
Release Date: 2006-04-04
Last Update: 2006-04-06
Critical:
Moderately critical
Impact: Spoofing
Where: From remote
Solution Status: Unpatched
Software: Microsoft Internet Explorer 6.x
Exploit code is out! Want to know when a patch is?
- Sign up - we will alert you!
CVE reference: CAN-2006-1626
Description:
Hai Nam Luke has discovered a vulnerability in Internet Explorer, which can be exploited by malicious people to conduct phishing attacks.
The vulnerability is caused due to a race condition in the loading of web content and Macromedia Flash Format files (".swf") in browser windows. This can be exploited to spoof the address bar in a browser window showing web content from a malicious web site.
Secunia has constructed a test, which can be used to check if your browser is affected by this issue:
http://secunia.com/Internet_Explorer_Address_Bar_Spoofing_Vulnerability_Test/
The vulnerability has been confirmed on a fully patched system with Internet Explorer 6.0 and Microsoft Windows XP SP1/SP2. The vulnerability has also been confirmed in Internet Explorer 7 Beta 2 Preview (March edition). Other versions may also be affected.
Solution:
Disable Active Scripting support.
Provided and/or discovered by:
Hai Nam Luke
Changelog:
2006-04-05: Hai Nam Luke provided additional information. Updated "Description" section and increased criticality.
2006-04-06: Added CVE reference. Added information about Internet Explorer 7 Beta 2 Preview being affected.
Please note: The information, which this Secunia Advisory is based upon, comes from third party unless stated otherwise.
Secunia collects, validates, and verifies all vulnerability reports issued by security research groups, vendors, and others.
Explorer turvaaukko1
jone74
1
300
Vastaukset
- Anonyymi
edgessä samat aukot ja vaklaus
Ketjusta on poistettu 0 sääntöjenvastaista viestiä.
Luetuimmat keskustelut
Ikävä sinua
Onkohan sulla ollut sama tunne kuin mulla viimeisten parin päivän aikana, eilen varsinkin. Ollaan oltu ihan lähellä ja k395268- 853762
- 503170
- 623045
- 113035
Kesäseuraa
Kesäseuraa mukavasta ja kauniista naisesta. Viesti tänään mulle muualla asiasta jos kiinnostaa Ne ketä tahansa huoli, t562393- 411878
Kiusaaja otti yhteyttä, mitä tekisit?
Minulle kävi näin pari kk sitten. Olin aluksi todella ystävällinen. Sanoin, että olin jo unohtanut jne. Asia jäi vai1461867Tuksu on edelleen sinkku - nuori Joonas jätti!
Hihhahihhahhaahheee Joonas keksi hyvän syy. : Tuksu on liian Disney-prinsessa hänelle. (Mikähän prinsessa lie kyseessä….101825- 181751