3 NEW Vulnerabilities in Microsoft Internet Explorer 6.0, 5.5, and 5.01

Multiple vulnerabilities exist in Microsoft Internet Explorer (IE). The first vulnerability results from IE's improper handling of dotless IP addresses. For example, if an attacker enters an address of http://3473223093 instead of http://207.5.45.181 and formats the request in a particular way, IE uses the intranet zone to open the site rather than the correct Internet zone. This vulnerability doesn't affect IE 6.0.

The second vulnerability involves how IE handles URLs that specify third-party sites. By encoding an URL in a particular way, an attacker can include and send HTTP requests to the site after establishing a connection and it will look like a qualified user sent the requests. If exploited against a Web-based service (such as a Web-based mail service), the attacker can take action on the user’s behalf, including sending a request to delete data.

The third vulnerability is a new variant of a vulnerability that Microsoft originally reported in Security Bulletin MS01-015. This vulnerability affects how an attacker can use IE to invoke Telnet sessions. By design, users can use IE to launch Telnet sessions, but doing so starts Telnet using any command-line options the Web site specifies...

Multiple Vulnerabilities in Microsoft Internet Explorer

Reported October 10, 2001, by Microsoft.

VERSIONS AFFECTED Microsoft Internet Explorer 6.0, 5.5, and 5.01

DESCRIPTION

The third vulnerability continued....This functionality becomes a concern only when using the Telnet client version that installs as part of Services for UNIX (SFU) 2.0 on Windows 2000 and Windows NT 4.0 machines. This version of the Telnet client provides an option for creating a verbatim transcript of a Telnet session. An attacker can use the logging option to start a Telnet session, and stream an executable file onto the user’s system in a location that automatically executes the file the next time the user boots the machine. The vulnerability doesn't lie in the Telnet client, but in IE, which shouldn't let an attacker start Telnet remotely with command-line arguments.

VENDOR RESPONSE

The vendor, Microsoft, has released Security Bulletin MS01-051 to address this vulnerability and recommends that affected users apply the patch provided. Microsoft will provide an NT 4.0 Terminal Services patch at the same security bulletin when it becomes available.

Click here to read the Microsoft Bulletin MS01-051

Click here to get the latest patch to fix up your IE Browser

CREDIT
Discovered by Michiel Kikkert (dotless IP vulnerability) and Joao Gouviea (HTTP request encoding vulnerability).