PT-2004-2076 · Microsoft · Internet Explorer
Publicado
2004-12-01
·
Atualizado
2018-10-19
·
CVE-2004-1104
CVSS v2.0
7.5
Alta
| Vetor | AV:N/AC:L/Au:N/C:P/I:P/A:P |
Name of the Vulnerable Software and Affected Versions:
Microsoft Internet Explorer version 6.0 SP2
Description:
The issue allows remote attackers to spoof a legitimate URL in the status bar and conduct a phishing attack. This is achieved through a web page that contains a BASE element pointing to the legitimate site, followed by an anchor (a) element with an empty
href attribute, and a FORM whose action points to a malicious URL, along with an INPUT submit element that is modified to look like a legitimate URL.Recommendations:
For Microsoft Internet Explorer version 6.0 SP2, consider disabling the ability to modify the status bar URL display as a temporary workaround until a patch is available. Restrict access to web pages that contain BASE elements with malicious FORM actions to minimize the risk of exploitation. Avoid using web pages with empty
href attributes in anchor elements until the issue is resolved.Exploit
Correção
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Internet Explorer