HTTP: IDN Hostname

This signature detects foreign characters in a hostname. Attackers can register a domain name that uses non-Latin international characters, then use the hostname to disguise the actual URL of a malicious Web site.

Extended Description

Multiple browsers are reported prone to vulnerabilities that surround the handling of International Domain Names. The vulnerabilities are caused by inconsistencies in how International Domain Names are processed. Reports indicate that attackers can leverage this to spoof address bars, status bars, and SSL certificate values. Remote attackers may exploit these vulnerabilities in phishing-style attacks. Through a false sense of trust, users may voluntarily disclose sensitive information to a malicious website. Although these vulnerabilities are reported to affect browsers, mail clients that depend on the browser to generate HTML code may also be affected.

Affected Products

Mozilla browser

References

BugTraq: 12461

CVE: CVE-2005-0233

URL: http://www.mozilla.org/security/announce/mfsa2005-29.html http://lists.grok.org.uk/pipermail/full-disclosure/2005-February/031459.html http://www.shmoo.com/idn/homograph.txt

Short Name

HTTP:INFO:IDN-HOSTNAME

Severity

Minor

Recommended

False

Recommended Action

None

HTTP: IDN Hostname

Extended Description

Affected Products

References

Found a potential security threat?