Multiple web browsers do not properly display the location of HTML documents in the status bar. An attacker could exploit this behavior to mislead users into revealing sensitive information.
Web browsers frequently display the Uniform Resource Locator (URL) in the status bar when a user moves the cursor over links contained within the page. A vulnerability exists in the way multiple web browsers interpret HTML to determine the correct URL to display in the browser's status bar.
The Hypertext Markup Language (HTML) supports the use of the TABLE element. The TABLE element is used to organize content into a series of rows and columns of cells within the document. When certain web browsers encounter a specific series of ANCHOR (e.g., <a href="..."></a>) and TABLE elements, they will display a URL in the status bar that is different than the URL that is accessed when the user clicks on the link.
An attacker could mislead a user to into believing that the URL specified in the status bar is the site that will be accessed when the user clicks on the link. However, when the user clicks on the link they will visit a site different than the URL specified in the status bar and potentially controlled by the attacker. The attacker could use additional social engineering techniques to trick the victim into disclosing sensitive information such as credit card numbers, account numbers, and passwords.
We are currently unaware of a practical solution to this problem.
Install Windows XP Service Pack 2 (SP2)
This vulnerability was reported by Benjamin Tobias Franz.
This document was written by Will Dormann and Damon Morda.
|Date First Published:||2004-11-04|
|Date Last Updated:||2004-11-05 18:54 UTC|