HTTP: Multiple Browsers CSS Status Bar Spoof
This signature detects attempts to exploit known flaws in several common HTTP browsers, including Microsoft Internet Explorer, Mozilla Firefox, Google Chrome, Opera, and Apple Safari. Attackers can craft a web page using Cascading Style Sheets (CSS) to include links that indicate via the Status Bar that clicking on them would take you to one site, but instead take you to a different site. Attackers can use this to enhance the credibility of phishing attacks to entice a user to go to what they think is a trusted site but is instead a malicious site.
Extended Description
Microsoft Internet Explorer is prone to a weakness that may allow an attacker to obfuscate a malicious link. Successful exploits of this issue will cause the status bar to display spoofed content that may aid in further attacks. Microsoft Internet Explorer 9 is vulnerable; other versions may also be affected.
Affected Products
Microsoft internet_explorer
Short Name
HTTP:STC:CSS-STATUS-BAR-SPOOF
Severity
Minor
Recommended
False
Recommended Action
Drop
Category
HTTP
Keywords
Bar Browsers CSS Multiple Spoof Status bid:47547 bid:47548 bid:47549
Release Date
04/29/2011
Supported Platforms
srx-branch-12.3
srx-19.3
srx-branch-19.3
vsrx3bsd-19.2
srx-branch-19.4
vsrx-19.4
mx-12.3
mx-19.4
vmx-19.4
mx-19.3
vsrx3bsd-19.4
srx-19.4
vsrx-12.3
vmx-19.3
vsrx-19.2
srx-12.3
Sigpack Version
3336
False Positive
Unknown
Vendors
Microsoft