Microsoft Internet Explorer ImageMap URL Spoof Vulnerability

[Kurczaba Associates advisories]

Microsoft Internet Explorer ImageMap URL Spoof Vulnerability

http://www.kurczaba.com/securityadvisories/0405132.htm
-------------------------------------------------------------

Vulnerability ID Number:
0405132


Overview:
A vulnerability has been found in Microsoft Internet Explorer. A
specially coded ImageMap can be used to spoof the URL displayed in the
lower, left hand corner of the browser.


Vendor:
Microsoft (http://www.microsoft.com)


Affected Systems/Configuration:
The versions affected by this vulnerability are Microsoft Internet
Explorer 5 and 6.


Vulnerability/Exploit:
An ImageMap can be used to spoof the URL displayed in the lower, left
hand of the browser. View the "Proof of Concept" example for details.


Workaround:
None so far.


Proof of Concept:
http://www.kurczaba.com/securityadvisories/0405132poc.htm


Date Discovered:
May 13, 2004


Severity:
High


Credit:
Paul Kurczaba
Kurczaba Associates
http://www.kurczaba.com/

[Drew Copley]

This bug is identical to malware's, which he posted five days
ago.

http://securityfocus.com/archive/1/362800/2004-05-07/2004-05-13/0

They both utilize the map object to the same end.

This "finding" even uses the same name for the same gif as Malware's
did.=20

It does appear to have obfuscated the original work so as to be
confusing, but that is it.

> -----Original Message-----
> From: Kurczaba Associates advisories [mailto:advisories@kurczaba.com]=20
> Sent: Monday, May 17, 2004 11:15 AM
> To: bugtraq@securityfocus.com
> Subject: Microsoft Internet Explorer ImageMap URL Spoof Vulnerability
>=20
> Microsoft Internet Explorer ImageMap URL Spoof Vulnerability
>=20
> http://www.kurczaba.com/securityadvisories/0405132.htm
> -------------------------------------------------------------
>=20
> Vulnerability ID Number:
> 0405132
>=20
>=20
> Overview:
> A vulnerability has been found in Microsoft Internet Explorer. A=20
> specially coded ImageMap can be used to spoof the URL=20
> displayed in the=20
> lower, left hand corner of the browser.
>=20
>=20
> Vendor:
> Microsoft (http://www.microsoft.com)
>=20
>=20
> Affected Systems/Configuration:
> The versions affected by this vulnerability are Microsoft Internet=20
> Explorer 5 and 6.
>=20
>=20
> Vulnerability/Exploit:
> An ImageMap can be used to spoof the URL displayed in the lower, left=20
> hand of the browser. View the "Proof of Concept" example for details.
>=20
>=20
> Workaround:
> None so far.
>=20
>=20
> Proof of Concept:
> http://www.kurczaba.com/securityadvisories/0405132poc.htm
>=20
>=20
> Date Discovered:
> May 13, 2004
>=20
>=20
> Severity:
> High
>=20
>=20
> Credit:
> Paul Kurczaba
> Kurczaba Associates
> http://www.kurczaba.com/
>=20
>=20
>=20
>=20

[thegeekmeister@SAFe-mail.net]

i find that this apparently works just the same in mozilla firefox on gentoo linux 2004.1. the only way to detect that this is an image, or an image map, at all is to look at the source, or to select the text, as right clicking does not allow saving imag
e or copying image location.

-------- Original Message --------
From: Kurczaba Associates advisories <advisories@kurczaba.com>
Apparently from: bugtraq-return-14371-thegeekmeister=safe-mail.net@securityfocus.com
To: bugtraq@securityfocus.com
Subject: Microsoft Internet Explorer ImageMap URL Spoof Vulnerability
Date: Mon, 17 May 2004 14:14:32 -0400

> Microsoft Internet Explorer ImageMap URL Spoof Vulnerability
>
> http://www.kurczaba.com/securityadvisories/0405132.htm
> -------------------------------------------------------------
>
> Vulnerability ID Number:
> 0405132
>
>
> Overview:
> A vulnerability has been found in Microsoft Internet Explorer. A
> specially coded ImageMap can be used to spoof the URL displayed in the
> lower, left hand corner of the browser.
>
>
> Vendor:
> Microsoft (http://www.microsoft.com)
>
>
> Affected Systems/Configuration:
> The versions affected by this vulnerability are Microsoft Internet
> Explorer 5 and 6.
>
>
> Vulnerability/Exploit:
> An ImageMap can be used to spoof the URL displayed in the lower, left
> hand of the browser. View the "Proof of Concept" example for details.
>
>
> Workaround:
> None so far.
>
>
> Proof of Concept:
> http://www.kurczaba.com/securityadvisories/0405132poc.htm
>
>
> Date Discovered:
> May 13, 2004
>
>
> Severity:
> High
>
>
> Credit:
> Paul Kurczaba
> Kurczaba Associates
> http://www.kurczaba.com/

[Jan Kluka]

On Mon, May 17, 2004 at 01:09:21PM -0800, thegeekmeister@SAFe-mail.net wrote:
> i find that this apparently works just the same in mozilla firefox on gentoo linux 2004.1. the only way to detect that this is an image, or an image map, at all is to look at the source, or to select the text, as right clicking does not allow saving im
age or copying image location.

It does NOT work in Mozilla Firefox 0.8 (official GNU/Linux gtk2+xft
build). If the cursor is in certain area _around_ the link, the statusbar
shows http://www.microsoft.com/, but when the cursor points _at_ the link,
the statusbar shows http://www.linux.com/.
Jan

>
> -------- Original Message --------
> From: Kurczaba Associates advisories <advisories@kurczaba.com>
> Apparently from: bugtraq-return-14371-thegeekmeister=safe-mail.net@securityfocus.com
> To: bugtraq@securityfocus.com
> Subject: Microsoft Internet Explorer ImageMap URL Spoof Vulnerability
> Date: Mon, 17 May 2004 14:14:32 -0400
>
> > Microsoft Internet Explorer ImageMap URL Spoof Vulnerability
> >
> > http://www.kurczaba.com/securityadvisories/0405132.htm
> > -------------------------------------------------------------
> >
> > Vulnerability ID Number:
> > 0405132
> >
> >
> > Overview:
> > A vulnerability has been found in Microsoft Internet Explorer. A
> > specially coded ImageMap can be used to spoof the URL displayed in the
> > lower, left hand corner of the browser.
> >
(...)

In-Reply-To: <40A90108.9000301@kurczaba.com>

I can't see this as vulnerability because its legal code I do something similar without using image map for my site to hide the affiliate tracking code.
This is the code:
<a onmouseover="window.status='http://www.the-url-you-see.com;return true"
title="The Link"
onmouseout="window.status='Whatever-you-like-here';return true"
href='http://www.some-other-url.com'>The link</a>

living example: http://lotdcrew.org/drunkteam_new/page/affiliates.php
------------------------------------------------
>Received: (qmail 26354 invoked from network); 17 May 2004 18:17:56 -0000
>Received: from outgoing.securityfocus.com (HELO outgoing3.securityfocus.com) (205.206.231.27)
> by mail.securityfocus.com with SMTP; 17 May 2004 18:17:56 -0000
>Received: from lists2.securityfocus.com (lists2.securityfocus.com [205.206.231.20])
> by outgoing3.securityfocus.com (Postfix) with QMQP
> id B52342371D4; Mon, 17 May 2004 20:13:15 -0600 (MDT)
>Mailing-List: contact bugtraq-help@securityfocus.com; run by ezmlm
>Precedence: bulk
>List-Id: <bugtraq.list-id.securityfocus.com>
>List-Post: <mailto:bugtraq@securityfocus.com>
>List-Help: <mailto:bugtraq-help@securityfocus.com>
>List-Unsubscribe: <mailto:bugtraq-unsubscribe@securityfocus.com>
>List-Subscribe: <mailto:bugtraq-subscribe@securityfocus.com>
>Delivered-To: mailing list bugtraq@securityfocus.com
>Delivered-To: moderator for bugtraq@securityfocus.com
>Received: (qmail 11770 invoked from network); 17 May 2004 12:00:16 -0000
>Message-ID: <40A90108.9000301@kurczaba.com>
>Date: Mon, 17 May 2004 14:14:32 -0400
>From: Kurczaba Associates advisories <advisories@kurczaba.com>
>User-Agent: Mozilla Thunderbird 0.6 (Windows/20040502)
>X-Accept-Language: en-us, en
>MIME-Version: 1.0
>To: bugtraq@securityfocus.com
>Subject: Microsoft Internet Explorer ImageMap URL Spoof Vulnerability
>Content-Type: text/plain; charset=us-ascii; format=flowed
>Content-Transfer-Encoding: 7bit
>
>Microsoft Internet Explorer ImageMap URL Spoof Vulnerability
>
>http://www.kurczaba.com/securityadvisories/0405132.htm
>-------------------------------------------------------------
>
>Vulnerability ID Number:
>0405132
>
>
>Overview:
>A vulnerability has been found in Microsoft Internet Explorer. A
>specially coded ImageMap can be used to spoof the URL displayed in the
>lower, left hand corner of the browser.
>
>
>Vendor:
>Microsoft (http://www.microsoft.com)
>
>
>Affected Systems/Configuration:
>The versions affected by this vulnerability are Microsoft Internet
>Explorer 5 and 6.
>
>
>Vulnerability/Exploit:
>An ImageMap can be used to spoof the URL displayed in the lower, left
>hand of the browser. View the "Proof of Concept" example for details.
>
>
>Workaround:
>None so far.
>
>
>Proof of Concept:
>http://www.kurczaba.com/securityadvisories/0405132poc.htm
>
>
>Date Discovered:
>May 13, 2004
>
>
>Severity:
>High
>
>
>Credit:
>Paul Kurczaba
>Kurczaba Associates
>http://www.kurczaba.com/
>
>
>

[http-equiv@excite.com]

<!--

<a onmouseover="window.status='http://www.the-url-you-
see.com;return true"
title="The Link"
onmouseout="window.status='Whatever-you-like-here';return true"
href='http://www.some-other-url.com'>The link</a>


-->

the point of the exercise is that default settings for the most
popular MUA's out there today have scripting disabled.

--
http://www.malware.com

[Robert J Taylor]

sandrijeski@yahoo.com wrote:

>In-Reply-To: <40A90108.9000301@kurczaba.com>
>
>I can't see this as vulnerability because its legal code I do something similar without using image map for my site to hide the affiliate tracking code.
>This is the code:
><a onmouseover="window.status='http://www.the-url-you-see.com;return true"
>title="The Link"
>onmouseout="window.status='Whatever-you-like-here';return true"
>href='http://www.some-other-url.com'>The link</a>
>
>
>
Being able to do something intentionally doesn't make it safe or
ethical. You are hiding tracking information from the person using your
site; in effect and in fact you are lying to your visitor. As a visitor
to your site I would not appreciate my browser hiding the real contents
of information used to track me and or hide the real purpose of a
benign-looking link. I would want my browser to be my agent, not yours.

Your anecdote rather establishes the vulnerability and points to its
current use "in the wild."


Regards,

Robert J Taylor
robert-bugtraq@rjamestaylor.com

[Valdis.Kletnieks@vt.edu]

--==_Exmh_-2072013602P
Content-Type: text/plain; charset=us-ascii

On Thu, 27 May 2004 09:53:33 -0000, sandrijeski@yahoo.com said:
> I can't see this as vulnerability because its legal code I do something similar without using image map for my site to hide the affiliate tracking code.

> <a onmouseover="window.status='http://www.the-url-you-see.com;return true"
> title="The Link"
> onmouseout="window.status='Whatever-you-like-here';return true"
> href='http://www.some-other-url.com'>The link</a>

Two points:

1) Your method doesn't work if the browser has disabled Javascript. Many people
disable Javascript precisely because they don't like the concept of web page designers
doing this sort of obfuscation. The fact that there exists a way to work around
disabled Javascript *is* a vulnerability...

2) The fact that there are other ways to achieve the same end doesn't mean that
it's not a vulnerability. Or do you claim that because so-called "419 scams"
have been run in the past using fax spam rather than e-mail spam, that e-mail
based 419 scams are therefor not a fraud? Or that because sidewalk con artists
have been playing 3-card monte that pigeon drop scams aren't fraud?


--==_Exmh_-2072013602P
Content-Type: application/pgp-signature

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)
Comment: Exmh version 2.5 07/13/2001

iD8DBQFAtkXbcC3lWbTT17ARAnUUAKDJPIjeAaMjvy/jgLrocpImBGPttACeIV9A
ibNZLOHs41sMIZShqvFwIyc=
=uMLr
-----END PGP SIGNATURE-----

--==_Exmh_-2072013602P--

[Peter Pentchev]

--r5Pyd7+fXNt84Ff3
Content-Type: text/plain; charset=windows-1251
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Thu, May 27, 2004 at 09:53:33AM -0000, sandrijeski@yahoo.com wrote:
> In-Reply-To: <40A90108.9000301@kurczaba.com>
>=20
> I can't see this as vulnerability because its legal code I do
> something similar without using image map for my site to hide the
> affiliate tracking code.
>=20
> This is the code:
> <a onmouseover=3D"window.status=3D'http://www.the-url-you-see.com;return =
true"=20
> title=3D"The Link"
> onmouseout=3D"window.status=3D'Whatever-you-like-here';return true"
> href=3D'http://www.some-other-url.com'>The link</a>
>=20
> living example: http://lotdcrew.org/drunkteam_new/page/affiliates.php

Well, yes, it's true that with JavaScript and window.status we can never
trust the status line again, but the point of the original posting was
that this could be done on browsers with JavaScript *disabled*.

G'luck,
Peter

--=20
Peter Pentchev roam@ringlet.net roam@sbnd.net roam@FreeBSD.org
PGP key: http://people.FreeBSD.org/~roam/roam.key.asc
Key fingerprint FDBA FD79 C26F 3C51 C95E DF9E ED18 B68D 1619 4553
I've heard that this sentence is a rumor.

--r5Pyd7+fXNt84Ff3
Content-Type: application/pgp-signature
Content-Disposition: inline

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (FreeBSD)

iD8DBQFAttTV7Ri2jRYZRVMRAtLVAJ9ro365aH1s5+Ou2P4mKL 0g1stEOQCgwep7
zb/xYEwRFjItRrES5Yqhd70=
=cyas
-----END PGP SIGNATURE-----

--r5Pyd7+fXNt84Ff3--

[James C Slora Jr]

> <a onmouseover="window.status='http://www.the-url-you-
> see.com;return true"
> title="The Link"
> onmouseout="window.status='Whatever-you-like-here';return true"
> href='http://www.some-other-url.com'>The link</a>
>
>
> -->
>
> the point of the exercise is that default settings for the
> most popular MUA's out there today have scripting disabled.

True. This works better. From the wild.

A
HREF="https://web.da-us.citibank.com/signin/scripts/Iogin2/user_setup.jsp"><
map name="FPMap0"><area coords="0, 0, 610, 275" shape="rect"
href="http://%32%31%37%2E%33%37%2E%32%31%31%2E%32%35%30:%34%39% 30%33/%63%69%
74/%69%6E%64%65%78%2E%68%74%6D"></map><img
SRC="cid:part1.07010704.01060800@user-billing47@citibank.com" border="0"
usemap="#FPMap0"</A>

The cid reference points to an embedded GIF that looks like hyperlinked text
https://web.da-us.citibank.com/signin/scripts/Iogin2/user_setup.jsp