CVE-2004-0526 Unknown versions of Internet Explorer and Outlook allow remote attackers to spoof a legitimate URL in the status bar via A HREF tags with modified "alt" values that point to the legitimate site, combi...
MediumCVSS 5.0
EPSS 18.8%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Unknown versions of Internet Explorer and Outlook allow remote attackers to spoof a legitimate URL in the status bar via A HREF tags with modified "alt" values that point to the legitimate site, combined with an image map whose href points to the malicious site, which facilitates a "phishing" attack.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Microsoft ie | = 6.0-sp1 | No fix listed |
| Microsoft internet explorer | = 5.0 | No fix listed |
| Microsoft internet explorer | = 5.0.1 | No fix listed |
| Microsoft internet explorer | = 5.0.1-sp1 | No fix listed |
| Microsoft internet explorer | = 5.0.1-sp2 | No fix listed |
| Microsoft internet explorer | = 5.0.1-sp3 | No fix listed |
| Microsoft internet explorer | = 5.0.1-sp4 | No fix listed |
| Microsoft internet explorer | = 5.5 | No fix listed |
| Microsoft internet explorer | = 5.5-sp1 | No fix listed |
| Microsoft internet explorer | = 5.5-sp2 | No fix listed |
| Microsoft internet explorer | = 6.0 | No fix listed |
| Microsoft outlook | = 97 | No fix listed |
| Microsoft outlook | = 98 | No fix listed |
| Microsoft outlook | = 2000 | No fix listed |
| Microsoft outlook | = 2000-sp2 | No fix listed |
| Microsoft outlook | = 2000-sp3 | No fix listed |
| Microsoft outlook | = 2000-sr1 | No fix listed |
| Microsoft outlook | = 2002 | No fix listed |
| Microsoft outlook | = 2002-sp1 | No fix listed |
| Microsoft outlook | = 2002-sp2 | No fix listed |
| Microsoft outlook | = 2002-sp3 | No fix listed |
| Microsoft outlook | = 2003 | No fix listed |
| Microsoft outlook express | = 4.0 | No fix listed |
| Microsoft outlook express | = 4.01-sp2 | No fix listed |
| Microsoft outlook express | = 4.27.3110 | No fix listed |
Show 7 more
| Product | Affected versions | Fixed in |
|---|---|---|
| Microsoft outlook express | = 4.72.2106 | No fix listed |
| Microsoft outlook express | = 4.72.3120.0 | No fix listed |
| Microsoft outlook express | = 4.72.3612 | No fix listed |
| Microsoft outlook express | = 5.0 | No fix listed |
| Microsoft outlook express | = 5.0.1 | No fix listed |
| Microsoft outlook express | = 5.5 | No fix listed |
| Microsoft outlook express | = 6.0 | No fix listed |
References
- 20040517 Microsoft Internet Explorer ImageMap URL Spoof Vulnerability mailing-list
- 20040510 DEEP SEA PHISHING: Internet Explorer / Outlook Express mailing-list
- www.kurczaba.com
- 10308 exploit vdb-entry vendor-advisory
- ie-ahref-url-spoofing(16102) vdb-entry