Vulnerability Note VU#960454

Microsoft Internet Explorer does not properly interpret IFRAME elements when displaying URLs in the status bar

Overview

Microsoft Internet Explorer does not properly display the location of HTML documents in the status bar. An attacker could exploit this behavior to mislead users into revealing sensitive information.

I. Description

Web browsers frequently display the Uniform Resource Locator (URL) in the status bar when a user moves the cursor over links contained within the page. A vulnerability exists in the way Microsoft Internet Explorer interprets HTML to determine the correct URL to display in the browser's status bar.

The Hypertext Markup Language (HTML) supports the use of the IFRAME element. The IFRAME element is used to display an in-line frame that contains the contents of another document. For instance, assume that a web developer specifies the following tag in an HTML document:

The IFRAME element creates an in-line frame that contains another document.

<iframe src="

http://www.example.com

">

If the web developer includes the IFRAME element within a web page, the contents of the URL specified in the src property of the IFRAME will be displayed inline with the document.

When Internet Explorer encounters an IFRAME element that is contained within an ANCHOR element (e.g., <a href="..."></a>), it will use the ANCHOR element's URL to display in the status bar, but access the URL specified in the IFRAME element when the user clicks on the link.

Note: Exploitation of this vulnerability does not require Active scripting to be enabled.

II. Impact

An attacker could mislead a user to into believing that the URL specified in the status bar is the site that will be accessed when the user clicks on the link. However, when the user clicks on the link they will visit a site different than the URL specified in the status bar and potentially controlled by the attacker. The attacker could use additional social engineering techniques to trick the victim into disclosing sensitive information such as credit card numbers, account numbers, and passwords.

III. Solution

We are currently unaware of a practical solution to this problem.

Install Windows XP Service Pack 2 (SP2)

Microsoft Windows XP SP2 does not appear to be affected by this vulnerability.

Read and send email in plain text format

Outlook 2003, Outlook 2002 SP1, and Outlook 6 SP1 can be configured to view email messages in text format. Consider the security of fellow Internet users and send email in plain text format when possible. Note that reading and sending email in plain text will not necessarily prevent exploitation of this vulnerability.

Systems Affected

Vendor	Status	Date Updated
Apple Computer Inc.	Unknown	4-Nov-2004
KDE Desktop Environment Project	Unknown	4-Nov-2004
Microsoft Corporation	Vulnerable	4-Nov-2004
Mozilla	Unknown	4-Nov-2004
Opera Software	Unknown	4-Nov-2004

References

Credit

This vulnerability was reported by Benjamin Tobias Franz.

This document was written by Will Dormann and Damon Morda.

Other Information

Date Public	11/02/2004
Date First Published	11/04/2004 05:52:47 PM
Date Last Updated	11/05/2004
CERT Advisory
CVE Name
US-CERT Technical Alerts
Metric	0.33
Document Revision	11

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Get Adobe Reader