HTTP: Microsoft Internet Explorer OnBeforeUnload JavaScript Address Bar Spoofing

This signature detects attempts to exploit a known address bar spoofing vulnerability in Microsoft Internet Explorer. It is due to improper resource handling when the user navigates through address bar to a trusted site. An attacker can exploit this by constructing a specially crafted Web page to spoof the legitimate site. In a successful exploit, the victim believes he had left a Web page (after entering an address in the address bar) and the address bar implies that too, but in reality, Internet Explorer is prevented from doing so and it continues to display assorted content originating from the attacker.

Extended Description

Microsoft Internet Explorer is prone to a vulnerability that allows attackers to trap users at a particular webpage and spoof page transitions. Attackers may exploit this via a malicious page to spoof the contents and origin of a page that the victim may trust. This vulnerability may be useful in phishing or other attacks that rely on content spoofing. Internet Explorer 7 is vulnerable to this issue; other versions may also be affected.

Affected Products

Microsoft internet_explorer

References

BugTraq: 24911

CVE: CVE-2007-3826

Short Name

HTTP:STC:ON-BEFORE-UNLOAD

Severity

Major

Recommended

False

Recommended Action

Drop

HTTP: Microsoft Internet Explorer OnBeforeUnload JavaScript Address Bar Spoofing

Extended Description

Affected Products

References

Found a potential security threat?