Microsoft Windows Internet Explorer地址栏伪造漏洞(MS04-038)

漏洞信息详情

Microsoft Windows Internet Explorer地址栏伪造漏洞(MS04-038)

CNNVD编号：CNNVD-200411-008
危害等级：中危-->
危害等级：中危
CVE编号： CVE-2004-0844
漏洞类型：其他
发布时间： 2004-10-12
威胁类型：远程
更新时间： 2005-10-20
厂商： microsoft
漏洞来源： Microsoft Security...

漏洞简介

Microsoft Internet Explorer是一款流行的WEB浏览器。 Microsoft Internet Explorer处理部分URL时存在问题，远程攻击者可以利用这个漏洞伪造地址，欺骗用户。在双字节字符设置系统中的Microsoft Internet Explorer处理部分URL存在问题，攻击者可以导致不正确的URL列在地址栏中，而非实际用户要访问的URL，造成一定的欺骗，可能导致用户访问恶意站点，泄露敏感信息。

漏洞公告

厂商补丁： Microsoft --------- Microsoft已经为此发布了一个安全公告(MS04-038)以及相应补丁:

MS04-038：Cumulative Security Update for Internet Explorer (834707)

链接： http://www.microsoft.com/technet/security/bulletin/MS04-038.mspx

补丁下载：

Internet Explorer 5.01 Service Pack 3 on Windows 2000 SP3

http://www.microsoft.com/downloads/details.aspx?FamilyId=2D8E8E97-4946-4994-924B-1FB1DC1881BA&displaylang=en

Internet Explorer 5.01 Service Pack 4 on Windows 2000 SP4

http://www.microsoft.com/downloads/details.aspx?FamilyId=72DBE239-AF0A-42B5-B88C-A00371F6EC81&displaylang=en

Internet Explorer 5.5 Service Pack 2 on Microsoft Windows Me

http://www.microsoft.com/downloads/details.aspx?FamilyId=BE27F77C-3C2D-45F1-86DF-2B71799DA169&displaylang=en

Internet Explorer 6 on Windows XP

http://www.microsoft.com/downloads/details.aspx?FamilyId=A89CFBE8-C299-415D-A9D6-7CC6429C547D&displaylang=en

Internet Explorer 6 Service Pack 1 on Microsoft Windows 2000 Service Pack 3, on Microsoft Windows 2000 Service Pack 4, on Microsoft Windows XP, or on Microsoft Windows XP Service Pack 1

http://www.microsoft.com/downloads/details.aspx?FamilyId=7C1404E6-F5D4-4FED-9573-DD83F2DFF074&displaylang=en

Internet Explorer 6 Service Pack 1 on Microsoft Windows NT Server 4.0 Service Pack 6a, on Microsoft Windows NT Server 4.0 Terminal Service Edition Service Pack 6, on Microsoft Windows 98, on Microsoft Windows 98 SE, or on Microsoft Windows Me

http://www.microsoft.com/downloads/details.aspx?FamilyId=DE8D94C4-7F58-4CE7-B8BD-51CFD795B03E&displaylang=en

Internet Explorer 6 for Windows XP Service Pack 1 (64-Bit Edition)

http://www.microsoft.com/downloads/details.aspx?FamilyId=C05103E8-4402-4D54-BA03-FBBC24142E4D&displaylang=en

Internet Explorer 6 for Windows Server 2003

http://www.microsoft.com/downloads/details.aspx?FamilyId=19E69E5F-9C98-49AD-A61F-4F82A4014412&displaylang=en

Internet Explorer 6 for Windows Server 2003 64-Bit Edition and Windows XP 64-Bit Edition Version 2003

http://www.microsoft.com/downloads/details.aspx?FamilyId=566C2A05-2513-4E30-A3EA-87D4BF7F9730&displaylang=en

Internet Explorer 6 for Windows XP Service Pack 2

http://www.microsoft.com/downloads/details.aspx?FamilyId=CF47B515-3F51-43E1-9246-2C2264C49E2E&displaylang=en

参考网址

来源:US-CERT Technical Alert: TA04-293A 名称: TA04-293A 链接:http://www.us-cert.gov/cas/techalerts/TA04-293A.html 来源:US-CERT Vulnerability Note: VU#431576 名称: VU#431576 链接:http://www.kb.cert.org/vuls/id/431576 来源: XF 名称: ie-dbcs-obtain-information(17652) 链接:http://xforce.iss.net/xforce/xfdb/17652 来源: XF 名称: ie-ms04038-patch(17651) 链接:http://xforce.iss.net/xforce/xfdb/17651 来源: MS 名称: MS04-038 链接:http://www.microsoft.com/technet/security/bulletin/ms04-038.mspx 来源: NTBUGTRAQ 名称: 20041128 Address Bar Spoofing on Double Byte Character Set Locale Vulnerability (CAN-2004-0844) Patched in MS04-038 链接:http://marc.theaimsgroup.com/?l=ntbugtraq&m=110174346717733&w=2 来源: BUGTRAQ 名称: 20041128 Address Bar Spoofing on Double Byte Character Set Locale Vulnerability (CAN-2004-0844) Patched in MS04-038 链接:http://marc.theaimsgroup.com/?l=bugtraq&m=110178042025729&w=2 来源: US Government Resource: oval:org.mitre.oval:def:8127 名称: oval:org.mitre.oval:def:8127 链接:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:8127 来源: US Government Resource: oval:org.mitre.oval:def:2448 名称: oval:org.mitre.oval:def:2448 链接:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:2448

受影响实体

Microsoft Ie:6:Windows_server_2003_sp1

补丁

暂无

正文

Microsoft Windows Internet Explorer地址栏伪造漏洞(MS04-038)

漏洞信息详情