Title: Microsoft Internet Explorer Cached Web Credentials Disclosure Vulnerability
Severity: MODERATE
Description:
Plaintext communication between a client using Microsoft Internet Explorer and a 128-bit SSL secured server could be monitored under certain circumstances, thereby allowing for the possibility of userids, passwords, and other sensitive information to be disclosed to a third party.
When performing authentication to a secured website, Internet Explorer will pass along credentials such as userids and passwords and store them in a cache for later retrieval if requested by the website. In the case that Basic HTTP Authentication is used to connect to the secure website, Internet Explorer will send credentials to non-secure parts of the website when in theory it should only be sending them to secure pages. Transmittal of credentials over insecure channels makes it feasible for a malicous third party to obtain plaintext userids and passwords. This is under the condition that the thirdy party can listen to network traffic between the client and server. In addition, any credentials could only be retrieved by a third party during the duration of the user's current browsing session.
This vulnerability does not affect Internet Explorer 5.5, only prior versions.
Affected Products:
- Microsoft Internet Explorer 4.0.0
- Microsoft Internet Explorer 4.0.0 for Windows 3.1
- Microsoft Internet Explorer 4.0.0 for Windows 95
- Microsoft Internet Explorer 4.0.0 for Windows NT 3.51
- Microsoft Internet Explorer 4.0.0 for Windows NT 4.0
- Microsoft Internet Explorer 4.0.1
- Microsoft Internet Explorer 4.0.1 for Windows 98
- Microsoft Internet Explorer 4.0.1 for Windows NT 4.0
- Microsoft Internet Explorer 4.1.0 for Windows 95
- Microsoft Internet Explorer 4.1.0 for Windows 98
- Microsoft Internet Explorer 4.1.0 for Windows NT 4.0
- Microsoft Internet Explorer 5.0 for Windows 95
- Microsoft Internet Explorer 5.0 for Windows 98
- Microsoft Internet Explorer 5.0.1
- Microsoft Windows 95
- Microsoft Windows 98
- Microsoft Windows NT 4.0
References:
- Microsoft: Frequently Asked Questions: Microsoft Security Bulletin (MS00-076)
- Microsoft: Q273868: Patch Available for the Cached Web Credentials Vulnerability
Juniper Networks provides this content via a wide variety of sources and production methods. If notified of errors or omissions in the content of this page, Juniper Networks, at its discretion, will modify or remove the page or leave the content as is, depending on various factors including but not limited to the reputation and authority of the party providing the notification. Please use the contact information displayed elsewhere on this page to report any errors or omissions regarding the content on this page.
