PT-2004-2076 · Microsoft · Internet Explorer
Published
2004-12-01
·
Updated
2018-10-19
·
CVE-2004-1104
CVSS v2.0
7.5
High
| Vector | AV:N/AC:L/Au:N/C:P/I:P/A:P |
Name of the Vulnerable Software and Affected Versions:
Microsoft Internet Explorer version 6.0 SP2
Description:
The issue allows remote attackers to spoof a legitimate URL in the status bar and conduct a phishing attack. This is achieved through a web page that contains a BASE element pointing to the legitimate site, followed by an anchor (a) element with an empty
href attribute, and a FORM whose action points to a malicious URL, along with an INPUT submit element that is modified to look like a legitimate URL.Recommendations:
For Microsoft Internet Explorer version 6.0 SP2, consider disabling the ability to modify the status bar URL display as a temporary workaround until a patch is available. Restrict access to web pages that contain BASE elements with malicious FORM actions to minimize the risk of exploitation. Avoid using web pages with empty
href attributes in anchor elements until the issue is resolved.Exploit
Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Internet Explorer