Vulnerability Note VU#625616

Microsoft Internet Explorer does not properly handle navigations from plug-ins

Overview

Microsoft Internet Explorer contains a vulnerability in its handling of navigation commands from plug-ins. This could let an attacker spoof the address of a website.

I. Description

Microsoft Internet Explorer improperly handles navigations from plug-ins, such as ActiveX controls. This improper navigation handling could cause IE to display an incorrect URL in the Address bar. As a result, a web site operator could make it appear that the content from his or her web site actually originated from another site when, in fact, it did not.

II. Impact

This vulnerability could be used to convince a user that the intruder's web site was actually a web site that the user trusts and might provide sensitive information to.

III. Solution

Apply a patch

Apply the patch referenced in MS04-038.

Systems Affected

Vendor	Status	Date Notified	Date Updated
Microsoft Corporation	Vulnerable	13-Oct-2004

References

http://www.microsoft.com/technet/security/bulletin/MS04-038.mspx
http://securitytracker.com/alerts/2004/Oct/1011644.html

Credit

Thanks to Microsoft for reporting this vulnerability.

This document was written by Will Dormann, based on the information provided in the Microsoft Security Bulletin.

Other Information

Date Public:	2004-10-12
Date First Published:	2004-10-13
Date Last Updated:	2004-10-15
CERT Advisory:
CVE-ID(s):	CAN-2004-0843
NVD-ID(s):	CAN-2004-0843
US-CERT Technical Alerts:
Metric:	1.98
Document Revision:	6

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Get Adobe Reader