New URL spoofing bug in Microsoft Internet Explorer [Archief]

Bekijk Volledige Versie : New URL spoofing bug in Microsoft Internet Explorer

29/10/04, 02:25

New URL spoofing bug in Microsoft Internet Explorer

There is a security bug in Internet Explorer 6.0.2800.1106 (fully patched),
which allowes to show any faked target-address in the status bar of the
window.

The example below will display a faked URL ("http://www.microsoft.com/") in
the status bar of the window, if you move your mouse over the link. Click
on the link and IE will go to "http://www.google.com/" and NOT to
"http://www.microsoft.com/" .

<a href="http://www.microsoft.com/"><table><tr><td><a
href="http://www.google.com/">Click here</td></tr></table></a>

Description: Microsoft Internet Explorer can't handle links surrounded by a
table and an other link correct.

The bug can be exploited using HTML mail message too.

Affected software: Microsoft Internet Explorer, Microsoft Outlook Express,
....

Workaround: Don't click on non-trusted links. Or right-click on links to
see the real target. Or use Copy-and-Paste.

Regards,
Benjamin Tobias Franz
Germany

Larry Seltzer

29/10/04, 21:55

Windows XP SP2 (IE 6.0.2900.2180.xpsp_sp2_rtm.040803-2158)
Has no problem - the status bar says Google and the click goes to Google

Larry Seltzer
eWEEK.com Security Center Editor
http://security.eweek.com/
http://blog.ziffdavis.com/seltzer
larryseltzer@ziffdavis.com
-----Original Message-----
From: 0-1-2-3@gmx.de [mailto:0-1-2-3@gmx.de]
Sent: Thursday, October 28, 2004 5:38 PM
To: bugtraq@securityfocus.com
Subject: New URL spoofing bug in Microsoft Internet Explorer

New URL spoofing bug in Microsoft Internet Explorer

There is a security bug in Internet Explorer 6.0.2800.1106 (fully
patched), which allowes to show any faked target-address in the status
bar of the window.

The example below will display a faked URL ("http://www.microsoft.com/")
in the status bar of the window, if you move your mouse over the link.
Click on the link and IE will go to "http://www.google.com/" and NOT to
"http://www.microsoft.com/" .

<a href="http://www.microsoft.com/"><table><tr><td><a
href="http://www.google.com/">Click here</td></tr></table></a>

Description: Microsoft Internet Explorer can't handle links surrounded
by a table and an other link correct.

The bug can be exploited using HTML mail message too.

Affected software: Microsoft Internet Explorer, Microsoft Outlook
Express, ...

Workaround: Don't click on non-trusted links. Or right-click on links to
see the real target. Or use Copy-and-Paste.

Regards,
Benjamin Tobias Franz
Germany

GuidoZ

30/10/04, 00:55

Same version I tested, Larry. (Same results too, for the most part.)
Try looking at my page for another example (as I stated in my previous
emails), as well as a way it might "work" in a sense:
- http://www.guidoz.com/btstatusurl.html

FYI: It seems my emails from 10/28 may have not made it to the list
yet (?). They are included.

--
Peace. ~G

On Thu, 28 Oct 2004 22:14:28 -0400, Larry Seltzer
<larry@larryseltzer.com> wrote:
> Windows XP SP2 (IE 6.0.2900.2180.xpsp_sp2_rtm.040803-2158)
> Has no problem - the status bar says Google and the click goes to Google
>
> Larry Seltzer
> eWEEK.com Security Center Editor
> http://security.eweek.com/
> http://blog.ziffdavis.com/seltzer
> larryseltzer@ziffdavis.com
>
>
> -----Original Message-----
> From: 0-1-2-3@gmx.de [mailto:0-1-2-3@gmx.de]
> Sent: Thursday, October 28, 2004 5:38 PM
> To: bugtraq@securityfocus.com
> Subject: New URL spoofing bug in Microsoft Internet Explorer
>
> New URL spoofing bug in Microsoft Internet Explorer
>
> There is a security bug in Internet Explorer 6.0.2800.1106 (fully
> patched), which allowes to show any faked target-address in the status
> bar of the window.
>
> The example below will display a faked URL ("http://www.microsoft.com/")
> in the status bar of the window, if you move your mouse over the link.
> Click on the link and IE will go to "http://www.google.com/" and NOT to
> "http://www.microsoft.com/" .
>
> <a href="http://www.microsoft.com/"><table><tr><td><a
> href="http://www.google.com/">Click here</td></tr></table></a>
>
> Description: Microsoft Internet Explorer can't handle links surrounded
> by a table and an other link correct.
>
> The bug can be exploited using HTML mail message too.
>
> Affected software: Microsoft Internet Explorer, Microsoft Outlook
> Express, ...
>
> Workaround: Don't click on non-trusted links. Or right-click on links to
> see the real target. Or use Copy-and-Paste.
>
> Regards,
> Benjamin Tobias Franz
> Germany
>
>

Christopher J. Pilkington

30/10/04, 03:35

Under IE 6.0.2900.2180, this does not occur as you describe.

If the mouse pointer is pointed to the edge around the link,
"http://www.microsoft.com" is displayed, but when the pointer is
directly over the link, "http://www.google.com" is correctly
displayed.

On Thu, 28 Oct 2004 23:38:16 +0200, 0-1-2-3@gmx.de <0-1-2-3@gmx.de> wrote:
> New URL spoofing bug in Microsoft Internet Explorer
>
> There is a security bug in Internet Explorer 6.0.2800.1106 (fully patched),
> which allowes to show any faked target-address in the status bar of the
> window.
>
> The example below will display a faked URL ("http://www.microsoft.com/") in
> the status bar of the window, if you move your mouse over the link. Click
> on the link and IE will go to "http://www.google.com/" and NOT to
> "http://www.microsoft.com/" .
>
> <a href="http://www.microsoft.com/"><table><tr><td><a
> href="http://www.google.com/">Click here</td></tr></table></a>
>
> Description: Microsoft Internet Explorer can't handle links surrounded by a
> table and an other link correct.
>
> The bug can be exploited using HTML mail message too.
>
> Affected software: Microsoft Internet Explorer, Microsoft Outlook Express,
> ...
>
> Workaround: Don't click on non-trusted links. Or right-click on links to
> see the real target. Or use Copy-and-Paste.
>
> Regards,
> Benjamin Tobias Franz
> Germany
>
>

Jérôme ATHIAS

30/10/04, 04:55

In-Reply-To: <005401c4bd36$6fdf3800$d9ebb9d9@oemcomputer>

Doesn't work on
IE 6.0.2900.2180.xpsp_sp2, XP Pro SP2 French/German

Working well on
IE 6.0.2600.000IC, TSE4.0 SP6 German

Previous versions may be vulnerable

Regards,
Jerome ATHIAS

GuidoZ

30/10/04, 07:25

I'm not arguing that this isn't a bug mind you - it certainly is
something that should be looked at. (I haven't tested it myself... no
Windows box handy.) However, you can accomplish basically the same
thing with a little bit of inline javascript:

<a HREF="http://www.google.com/"
onMouseOver="window.status='http://www.microsoft.com/';return true"
onMouseOut="window.status='Done';return true">Click here</a>

Hovering over the link will display the "fake" Microsoft.com link in
the status bar. Leaving the link will revert to saying "Done" when
leaving the link. (Done is what appears in IE after a page is loaded.)
Clicking it will goto Google.com

This trivial, yet effective, method has been used for years for
advertising sites that want to hide the affiliate ID or whatever.
Plus, it's easier then making a table around every link, which will
throw off the formatting in some browers. =) On the other hand, if you
have javascript disabled (or not supported), then this wouldn't fool
you. 6 of one and half a dozen of the other. (Something else to note -
the inline javascript will work across multiple browsers. Not just
IE.) Either way, viewing the page source will reveal the truth,
obviously.

FWIW, I have made a quick page that hosts both "exploits" here as HTML:
- http://www.guidoz.com/btstatusurl.html

Now you can see them as HTML in case your mail program doesn't.
This was done *very* quickly in kwrite, so no comments about the coding. =P
(Let me know if something doesn't work like it should however and I'll fix it.)

--
Peace. ~G

On Thu, 28 Oct 2004 23:38:16 +0200, 0-1-2-3@gmx.de <0-1-2-3@gmx.de> wrote:
> New URL spoofing bug in Microsoft Internet Explorer
>
> There is a security bug in Internet Explorer 6.0.2800.1106 (fully patched),
> which allowes to show any faked target-address in the status bar of the
> window.
>
> The example below will display a faked URL ("http://www.microsoft.com/") in
> the status bar of the window, if you move your mouse over the link. Click
> on the link and IE will go to "http://www.google.com/" and NOT to
> "http://www.microsoft.com/" .
>
> <a href="http://www.microsoft.com/"><table><tr><td><a
> href="http://www.google.com/">Click here</td></tr></table></a>
>
> Description: Microsoft Internet Explorer can't handle links surrounded by a
> table and an other link correct.
>
> The bug can be exploited using HTML mail message too.
>
> Affected software: Microsoft Internet Explorer, Microsoft Outlook Express,
> ...
>
> Workaround: Don't click on non-trusted links. Or right-click on links to
> see the real target. Or use Copy-and-Paste.
>
> Regards,
> Benjamin Tobias Franz
> Germany
>
>

GuidoZ

30/10/04, 10:55

Update to my previous email (quoted below) which was in reply to
Benjamin's original email (quoted at bottom).

Using Win XP Pro w/ SP2 (Fully patched according to Windows Update -
IE version: 6.0.2900.2180), his example does NOT work. If you hover
your mouse just above the link (where the table border would be), it
says Microsoft.com, however, going over the actual link inside the
table will properly reveal Google.com. (Maybe Microsoft patched this?
Not sure what is meant by "fully patched" in Benjamin's text. Fully
patched according to what?)

My example still holds true however, as I expected. I wouldn't call it
a bug or an exploit really. It's more like an "abused feature" if
anything. It's not a glitch or an example of bad coding. It's just yet
another deceptive way to fool someone using the resources available.

Comments?
Email: exploit _AT_ guidoz _DOT_ com

More info here: http://www.guidoz.com/btstatusurl.html

--
Peace. ~G

On Fri, 29 Oct 2004 00:53:49 -0400, GuidoZ <uberguidoz@gmail.com> wrote:
> I'm not arguing that this isn't a bug mind you - it certainly is
> something that should be looked at. (I haven't tested it myself... no
> Windows box handy.) However, you can accomplish basically the same
> thing with a little bit of inline javascript:
>
> <a HREF="http://www.google.com/"
> onMouseOver="window.status='http://www.microsoft.com/';return true"
> onMouseOut="window.status='Done';return true">Click here</a>
>
> Hovering over the link will display the "fake" Microsoft.com link in
> the status bar. Leaving the link will revert to saying "Done" when
> leaving the link. (Done is what appears in IE after a page is loaded.)
> Clicking it will goto Google.com
>
> This trivial, yet effective, method has been used for years for
> advertising sites that want to hide the affiliate ID or whatever.
> Plus, it's easier then making a table around every link, which will
> throw off the formatting in some browers. =) On the other hand, if you
> have javascript disabled (or not supported), then this wouldn't fool
> you. 6 of one and half a dozen of the other. (Something else to note -
> the inline javascript will work across multiple browsers. Not just
> IE.) Either way, viewing the page source will reveal the truth,
> obviously.
>
> FWIW, I have made a quick page that hosts both "exploits" here as HTML:
> - http://www.guidoz.com/btstatusurl.html
>
> Now you can see them as HTML in case your mail program doesn't.
> This was done *very* quickly in kwrite, so no comments about the coding. =P
> (Let me know if something doesn't work like it should however and I'll fix it.)
>
> --
> Peace. ~G
>
>
>
>
> On Thu, 28 Oct 2004 23:38:16 +0200, 0-1-2-3@gmx.de <0-1-2-3@gmx.de> wrote:
> > New URL spoofing bug in Microsoft Internet Explorer
> >
> > There is a security bug in Internet Explorer 6.0.2800.1106 (fully patched),
> > which allowes to show any faked target-address in the status bar of the
> > window.
> >
> > The example below will display a faked URL ("http://www.microsoft.com/") in
> > the status bar of the window, if you move your mouse over the link. Click
> > on the link and IE will go to "http://www.google.com/" and NOT to
> > "http://www.microsoft.com/" .
> >
> > <a href="http://www.microsoft.com/"><table><tr><td><a
> > href="http://www.google.com/">Click here</td></tr></table></a>
> >
> > Description: Microsoft Internet Explorer can't handle links surrounded by a
> > table and an other link correct.
> >
> > The bug can be exploited using HTML mail message too.
> >
> > Affected software: Microsoft Internet Explorer, Microsoft Outlook Express,
> > ...
> >
> > Workaround: Don't click on non-trusted links. Or right-click on links to
> > see the real target. Or use Copy-and-Paste.
> >
> > Regards,
> > Benjamin Tobias Franz
> > Germany
> >
> >
>

30/10/04, 11:05

Hi,

I'm running Windows 98 and see "http://www.microsoft.com/" in status bar.
ONLY if I press tabulator-key twice (to jump to next link) or click on the
link, then I can see correct info ("http://www.google.com/") in status bar.

My DLL versions:

MSHTML.DLL: 6.00.2800.1477
BROWSEUI.DLL: 6.00.2800.1596 (xpsp2.040919-1003)
SHDOCVW.DLL: 6.00.2800.1596 (xpsp2.040919-1003)
SHLWAPI.DLL: 6.00.2800.1584 (xpsp2.040720-1705)
URLMON.DLL: 6.00.2800.1475
WININET.DLL: 6.00.2800.1475

Regards,
Benjamin Tobias Franz

Larry Seltzer

30/10/04, 20:15

Russ from NTBugTraq helped to clear some of this up. If you hover the
mouse below the actual link to Google - in a very narrow area - the
status bar will show www.microsoft.com, but clicking doesn't do
anything. So it's definitely a stupid error in IE, but the spoofing
angle in SP2 is debatable.

Larry Seltzer
eWEEK.com Security Center Editor
http://security.eweek.com/
http://blog.ziffdavis.com/seltzer
larryseltzer@ziffdavis.com
-----Original Message-----
From: GuidoZ [mailto:uberguidoz@gmail.com]
Sent: Friday, October 29, 2004 3:20 PM
To: Larry Seltzer
Cc: 0-1-2-3@gmx.de; bugtraq@securityfocus.com
Subject: Re: New URL spoofing bug in Microsoft Internet Explorer

Same version I tested, Larry. (Same results too, for the most part.) Try
looking at my page for another example (as I stated in my previous
emails), as well as a way it might "work" in a sense:
- http://www.guidoz.com/btstatusurl.html

FYI: It seems my emails from 10/28 may have not made it to the list yet
(?). They are included.

--
Peace. ~G

On Thu, 28 Oct 2004 22:14:28 -0400, Larry Seltzer
<larry@larryseltzer.com> wrote:
> Windows XP SP2 (IE 6.0.2900.2180.xpsp_sp2_rtm.040803-2158)
> Has no problem - the status bar says Google and the click goes to
> Google
>
> Larry Seltzer
> eWEEK.com Security Center Editor
> http://security.eweek.com/
> http://blog.ziffdavis.com/seltzer
> larryseltzer@ziffdavis.com
>
>
> -----Original Message-----
> From: 0-1-2-3@gmx.de [mailto:0-1-2-3@gmx.de]
> Sent: Thursday, October 28, 2004 5:38 PM
> To: bugtraq@securityfocus.com
> Subject: New URL spoofing bug in Microsoft Internet Explorer
>
> New URL spoofing bug in Microsoft Internet Explorer
>
> There is a security bug in Internet Explorer 6.0.2800.1106 (fully
> patched), which allowes to show any faked target-address in the status

> bar of the window.
>
> The example below will display a faked URL
> ("http://www.microsoft.com/") in the status bar of the window, if you
move your mouse over the link.
> Click on the link and IE will go to "http://www.google.com/" and NOT
> to "http://www.microsoft.com/" .
>
> <a href="http://www.microsoft.com/"><table><tr><td><a
> href="http://www.google.com/">Click here</td></tr></table></a>
>
> Description: Microsoft Internet Explorer can't handle links surrounded

> by a table and an other link correct.
>
> The bug can be exploited using HTML mail message too.
>
> Affected software: Microsoft Internet Explorer, Microsoft Outlook
> Express, ...
>
> Workaround: Don't click on non-trusted links. Or right-click on links
> to see the real target. Or use Copy-and-Paste.
>
> Regards,
> Benjamin Tobias Franz
> Germany
>
>

http-equiv@excite.com

30/10/04, 21:55

I also want to play

<base href="http://www.microsoft.com">

<a href=><form action="http://www.malware.com"
method="get"><INPUT style="BORDER-RIGHT: 0pt; BORDER-TOP: 0pt;
FONT-SIZE: 10pt; BORDER-LEFT: 0pt;
CURSOR: hand; COLOR: blue; BORDER-BOTTOM: 0pt; BACKGROUND-COLOR:
transparent;TEXT-DECORATION: underline" type=submit
value=http://www.microsoft.com></form></a>

This still works in IE 6 SP2 XP 123 whatever, since patched and
from back in March 2004 [see:
http://www.securityfocus.com/bid/10023 ]. Only difference being
the base href and open a href.

http://www.malware.com/mwaresoft.html

Interestingly Outlook Express gets it right this time.

--
http://www.malware.com

roozbeh afrasiabi

09/11/04, 19:05

In-Reply-To: <005401c4bd36$6fdf3800$d9ebb9d9@oemcomputer>

Here is another way of spoofing the status bar:

<a> tag + <object> tag

<!--A HREF=http://www.yahoo.com><!--OBJECT classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000"
codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,0,0"
WIDTH="300" HEIGHT="50" id="link" ALIGN="">
<PARAM NAME=movie VALUE="link.swf"> <PARAM NAME=quality VALUE=high > <PARAM NAME=bgcolor VALUE=********> <PARAM NAME=menu
VALU=FALSE>
<EMBED src="link.swf" quality=high bgcolor=******** WIDTH="300" HEIGHT="50" NAME="link" ALIGN=""
TYPE="application/x-shockwave-flash" PLUGINSPAGE="http://www.macromedia.com/go/getflashplayer"></EMBED>
</a></OBJECT></a>

*this method of spoofing the status bar allows malicious users to hide the target url from suspecting ppl ,demo page uses flash to generate
random urls.

demo:
http://www.persiax.com/pocs/statusbar/status.htm

http-equiv@excite.com

11/11/04, 23:25

Since we're going the whole nine yards here, let's toss in the following
as well:

1. This will of course give a different reading in the status bar
2. More importantly it will bypass the so-called 'popup blocker' in IE XP
SP2

It's a hand-made Excel spreadsheet using OWC11 for Office 2003. One might
suspect that the older versions will function the same.

[screenshot: http://www.malware.com/xcellente.png 5 KB]

Perhaps someone with more knowledge can get it to automate:

'foo.ActiveCell.openHyperlink
'foo.Worksheets(1).Hyperlinks(1).Follow

Then you're back in the popup business.

Raw functional incomplete demo here:
[OWC11: switch on your IE popup blocker]

http://www.malware.com/xcellent.html

--
http://www.malware.com

q q

17/11/04, 03:55

I thought this was obvious, but having seen the amount of discussion,
here's another URL spoofer:

<a href="http://www.google.com"
onmousemove="window.status='http://www.msn.com';"
onmouseout="window.status='Done.';">Visit Msn!</a>

note that

<a href="http://www.google.com"
onmouseover="window.status='http://www.msn.com';"
onmouseout="window.status='Done.';">Visit Msn!</a>

won't work - it seems MS have already half fixed this....

(tested on MSIE 6.0, winXP)

On 8 Nov 2004 23:30:55 -0000, roozbeh afrasiabi
<roozbeh_afrasiabi@yahoo.com> wrote:
> In-Reply-To: <005401c4bd36$6fdf3800$d9ebb9d9@oemcomputer>
>
> Here is another way of spoofing the status bar:
>
> <a> tag + <object> tag
>
> <!--A HREF=http://www.yahoo.com><!--OBJECT classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000"
>
> codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,0,0"
>
> WIDTH="300" HEIGHT="50" id="link" ALIGN="">
>
> <PARAM NAME=movie VALUE="link.swf"> <PARAM NAME=quality VALUE=high > <PARAM NAME=bgcolor VALUE=********> <PARAM NAME=menu
>
> VALU=FALSE>
>
> <EMBED src="link.swf" quality=high bgcolor=******** WIDTH="300" HEIGHT="50" NAME="link" ALIGN=""
>
> TYPE="application/x-shockwave-flash" PLUGINSPAGE="http://www.macromedia.com/go/getflashplayer"></EMBED>
>
> </a></OBJECT></a>
>
> *this method of spoofing the status bar allows malicious users to hide the target url from suspecting ppl ,demo page uses flash to generate
>
> random urls.
>
> demo:
>
> http://www.persiax.com/pocs/statusbar/status.htm
>
>

--
PHP, mySQL Security and more at http://www.puremango.co.uk

GuidoZ

17/11/04, 18:35

> <a href="http://www.google.com"
> onmousemove="window.status='http://www.msn.com';"
> onmouseout="window.status='Done.';">Visit Msn!</a>

Again, another way of "abusing a useful feature" more then an exploit.
=P Good point. (I pointed out something similar to this long ago. Read
on.)

> <a href="http://www.google.com"
> onmouseover="window.status='http://www.msn.com';"
> onmouseout="window.status='Done.';">Visit Msn!</a>

This certainly does still work, when coded correctly. Like this for example...

<a HREF="http://www.google.com/"
onMouseOver="window.status='http://www.microsoft.com/';return true"
onMouseOut="window.status='Done';return true">Visit Microsoft!</a>

I mentioned this quite awhile back actually (10-29-04). I documented
the method (as well as the original post) at the following page:
- http://www.guidoz.com/btstatusurl.html

I'm not sure if all my original emails ever made it to BT. I seem to
remember some bounced (I was out of town and didn't bother to
resubmit). A reason for this escapes me though. (One wasn't provided.)
Hopefully this will make it. =)

--
Peace. ~G

On Tue, 16 Nov 2004 16:11:05 +0000, q q <systemcracker@gmail.com> wrote:
> I thought this was obvious, but having seen the amount of discussion,
> here's another URL spoofer:
>
> <a href="http://www.google.com"
> onmousemove="window.status='http://www.msn.com';"
> onmouseout="window.status='Done.';">Visit Msn!</a>
>
> note that
>
> <a href="http://www.google.com"
> onmouseover="window.status='http://www.msn.com';"
> onmouseout="window.status='Done.';">Visit Msn!</a>
>
> won't work - it seems MS have already half fixed this....
>
> (tested on MSIE 6.0, winXP)
>
> On 8 Nov 2004 23:30:55 -0000, roozbeh afrasiabi
> <roozbeh_afrasiabi@yahoo.com> wrote:
> > In-Reply-To: <005401c4bd36$6fdf3800$d9ebb9d9@oemcomputer>
> >
> > Here is another way of spoofing the status bar:
> >
> > <a> tag + <object> tag
> >
> > <!--A HREF=http://www.yahoo.com><!--OBJECT classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000"
> >
> > codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,0,0"
> >
> > WIDTH="300" HEIGHT="50" id="link" ALIGN="">
> >
> > <PARAM NAME=movie VALUE="link.swf"> <PARAM NAME=quality VALUE=high > <PARAM NAME=bgcolor VALUE=********> <PARAM NAME=menu
> >
> > VALU=FALSE>
> >
> > <EMBED src="link.swf" quality=high bgcolor=******** WIDTH="300" HEIGHT="50" NAME="link" ALIGN=""
> >
> > TYPE="application/x-shockwave-flash" PLUGINSPAGE="http://www.macromedia.com/go/getflashplayer"></EMBED>
> >
> > </a></OBJECT></a>
> >
> > *this method of spoofing the status bar allows malicious users to hide the target url from suspecting ppl ,demo page uses flash to generate
> >
> > random urls.
> >
> > demo:
> >
> > http://www.persiax.com/pocs/statusbar/status.htm
> >
> >
>
> --
> PHP, mySQL Security and more at http://www.puremango.co.uk
>

Michael Silk

18/11/04, 07:15

Or even a fake "a" tag:

<span style=3D"color: blue; text-decoration: underline; cursor: hand;"
onmouseover=3D"window.status =3D 'http://www.msn.com/';"
onmouseout=3D"window.status =3D 'Done.'" onclick=3D"document.location =3D
'http://www.google.com'"> Visit Msn! </span>=20

-----Original Message-----
From: q q [mailto:systemcracker@gmail.com]=20
Sent: Wednesday, 17 November 2004 3:11 AM
To: bugtraq@securityfocus.com
Subject: Re: New URL spoofing bug in Microsoft Internet Explorer

I thought this was obvious, but having seen the amount of discussion,
here's another URL spoofer:

<a href=3D"http://www.google.com"
onmousemove=3D"window.status=3D'http://www.msn.com';"
onmouseout=3D"window.status=3D'Done.';">Visit Msn!</a>

note that=20

<a href=3D"http://www.google.com"
onmouseover=3D"window.status=3D'http://www.msn.com';"
onmouseout=3D"window.status=3D'Done.';">Visit Msn!</a>

won't work - it seems MS have already half fixed this....

(tested on MSIE 6.0, winXP)

On 8 Nov 2004 23:30:55 -0000, roozbeh afrasiabi
<roozbeh_afrasiabi@yahoo.com> wrote:
> In-Reply-To: <005401c4bd36$6fdf3800$d9ebb9d9@oemcomputer>
>=20
> Here is another way of spoofing the status bar:
>=20
> <a> tag + <object> tag
>=20
> <!--A HREF=3Dhttp://www.yahoo.com><!--OBJECT
classid=3D"clsid:D27CDB6E-AE6D-11cf-96B8-444553540000"
>=20
>
codebase=3D"http://download.macromedia.com/pub/shockwave/cabs/flash/swflas
h.cab#version=3D6,0,0,0"
>=20
> WIDTH=3D"300" HEIGHT=3D"50" id=3D"link" ALIGN=3D"">
>=20
> <PARAM NAME=3Dmovie VALUE=3D"link.swf"> <PARAM NAME=3Dquality VALUE=3Dhig=
h >=20
> <PARAM NAME=3Dbgcolor VALUE=3D********> <PARAM NAME=3Dmenu
>=20
> VALU=3DFALSE>
>=20
> <EMBED src=3D"link.swf" quality=3Dhigh bgcolor=3D******** WIDTH=3D"300"
HEIGHT=3D"50" NAME=3D"link" ALIGN=3D""
>=20
> TYPE=3D"application/x-shockwave-flash"=20
> PLUGINSPAGE=3D"http://www.macromedia.com/go/getflashplayer"></EMBED>
>=20
> </a></OBJECT></a>
>=20
> *this method of spoofing the status bar allows malicious users to hide

> the target url from suspecting ppl ,demo page uses flash to generate
>=20
> random urls.
>=20
> demo:
>=20
> http://www.persiax.com/pocs/statusbar/status.htm
>=20
>=20

--
PHP, mySQL Security and more at http://www.puremango.co.uk

************************************************** ********************
This email message and accompanying data may contain information that is co=
nfidential and/or subject to legal privilege. If you are not the intended r=
ecipient, you are notified that any use, dissemination, distribution or cop=
ying of this message or data is prohibited. If you have received this email=
message in error, please notify us immediately and erase all copies of thi=
s message and attachments.

This email is for your convenience only, you should not rely on any informa=
tion contained herein for contractual or legal purposes. You should only re=
ly on information and/or instructions in writing and on company letterhead =
signed by authorised persons.
************************************************** ********************