SMTP: Email With Malicious URL Hiding Encoding

This signature detects attempts to exploit a known vulnerability in Microsoft Outlook Express. Attackers can embed binary control characters in a URL that is included in an email; when the URL is viewed, these control characters prevent Outlook Express and Internet Explorer from displaying the complete URL, which can have malicious content.

Extended Description

A weakness has been reported in multiple browsers that may allow attackers to obfuscate the URI for a visited page. The problem is said to occur when a URI designed to pass access a specific location with a supplied username, contains a hexadecimal 1 value prior to the @ symbol. An attacker could exploit this issue by supplying a malicious URI pointing to a page designed to mimic that of a trusted site, and tricking a victim who follows a link into believing they are actually at the trusted location.

Affected Products

Microsoft outlook_xp

References

BugTraq: 9182

CVE: CVE-2003-1025

URL: http://www.microsoft.com/technet/security/bulletin/MS04-004.mspx http://www.kb.cert.org/vuls/id/652278

Short Name

SMTP:MAL:EMAIL-URL-HIDING-ENC

Severity

Major

Recommended

False

Recommended Action

Drop

SMTP: Email With Malicious URL Hiding Encoding

Extended Description

Affected Products

References

Found a potential security threat?