PT-2006-3345 · Microsoft · Internet Explorer

Hoshikuzu Star_Dust + 1 · Published 2006-06-13 · Updated 2021-07-23 · CVE-2006-2384

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Microsoft Internet Explorer versions 5.01 SP4 and 6 SP1 and earlier

Description A spoofing issue exists that could allow an attacker to display spoofed content in a browser window. The address bar and other parts of the trust UI can be displayed from trusted Web sites, but the content of the window contains the attacker's Web page. This can be used to conduct spoofing and phishing attacks by using a modal browser window in a way that preserves the original address bar and trusted UI of a trusted site, even after the browser has been navigated to a malicious site.

Recommendations For Microsoft Internet Explorer versions 5.01 SP4 and 6 SP1 and earlier, consider disabling the use of modal browser windows until a patch is available. Restrict access to untrusted Web sites to minimize the risk of exploitation. Avoid using the address bar as the sole means of verifying the authenticity of a Web site until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2006-2384

Affected Products

Internet Explorer

References · 24

• http://secunia.com/advisories/20595 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2384 · Security Note
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-021 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2006-2384 · Security Note
• http://osvdb.org/26445 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/26777 · Note
• http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:1686 · Note
• http://securityfocus.com/bid/18321 · Note
• http://frsirt.com/english/advisories/2006/2319 · Note
• https://docs.microsoft.com/security-updates/securitybulletins/2006/ms06-021 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1775 · Note
• http://securitytracker.com/id?1016291 · Note
• http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:1478 · Note
• http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:1775 · Note
• http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:1788 · Note