Slashdot Mirror
New URL Spoofing Bug in Pre-SP2 IE
An anonymous reader writes "According to Netcraft a new security flaw has been found in Microsoft Internet Explorer which makes it possible to spoof a URL with just some simple HTML code, by enclosing two URLs and a table within a single href tag. The user will be sent to one site, but the status bar will show a fake URL. The bug apparently affects IE and Outlook Express up to but not including SP2. Firefox and Konqueror seem unaffected."
What's worse? IE being vulnerable to spoofed URLs because of malformed HTML, or Firefox crashing because of the same thing?
Gnash Gnash Gnash
Well, a semi-savvy IE user could have javascript turned off...but yeah, this strikes me as no big deal either, just another slam at IE.
Linux, you magnificent bastard, I read the fucking manual!
this is what porn sites have been doing for years, for those who want the secret here it comes
u rn false" onmouseover="top.status='http://google.com';return true" onmouseout="top.status='';return true">click here</a>
<a href="http://google.com" onclick="self.location='http://microsoft.com';ret
works on all browsers with JS capabilities by default (even webTV)
jerks who submit stories like this seem to be the only ones doing the exploiting
Comment removed based on user account deletion
From the article, "The flaw is possible because Internet Explorer has difficulty processing improperly formed HTML". If browsers had been pickier from the start, and refused to try to render improper HTML, perhaps we wouldn't see this sort of bug so often. Of course, now everyone expects to be able to view sites no matter how bad the code, so a 'correct' browser wouldn't be popular. Maybe browsers should start flagging improper HTML as a security risk; might actually get some people's attention.
IE's ability to parse anything meant it survived the problems which caused both Opera and Firefox to crash has also made this nastiness possible...
There's mischief and malarkies but no queers or yids or darkies within this bastard's carnival, this vicious cabaret.
That didn't work in my 1.0PR (Win) but this did:
<a href="http://www.microsoft.com/" onclick="location.href='http://www.google.com/';
return false"> ...
http://www.microsoft.com
</a>
In another thread somebody mentioned that if you turn off Javascript that this "URL Spoofing Bug" doesn't work either. Anybody with IE care to check it out?
Dlugar
Computer Go: Writing Software to Play the Ancient Game of Go
This type of bug is very minor. I never trust what the status bar says on mouse-over of a link. With a little bit of javascript, it's easy to have it say whatever you want. Many sites already employ this. All it does is annoy me.
The bottom line is, once you land on the site, what does it say in the address bar and the status bar then?
One other thing, be careful of misleading domains that replace "1" with an "l" or vice versa.
eTrade SUCKS