Internet Explorer update Q832894

[mwpc]

On Feb 2 I installed the MS update Q832894 for Internet Explorer on a pc running win2k.

Today Feb 5, a client in another location was having trouble accessing a website that places the htaccess username & password in the location tag for login, such as:

http://user:password@website.com/

I tried to access the site, and had the same problem with explorer, but netscape & mozilla worked fine. After I removed Q832894, the website could be accessed normally with explorer again.

 

[wbg34]

One of the vulnerabilities that that patch resolves is
A vulnerability that involves the incorrect parsing of URLs that contain special characters. When combined with a misuse of the basic authentication feature that has "usernameassword@" at the beginning of a URL, this vulnerability could result in a misrepresentation of the URL in the address bar of an Internet Explorer window. To exploit this vulnerability, an attacker would have to host a malicious Web site that contained a Web page that had a specially-crafted link. The attacker would then have to persuade a user to click that link. The attacker could also create an HTML e-mail message that had a specially-crafted link, and then persuade the user to view the HTML e-mail message and then click the malicious link. If the user clicked this link, an Internet Explorer window could open with a URL of the attacker's choice in the address bar, but with content from a Web Site of the attacker's choice inside the window. For example, an attacker could create a link that once clicked on by a user would display

http://www.tailspintoys.com

in the address bar, but actually contained content from another Web Site, such as

http://www.wingtiptoys.com.

(Note: these web sites are provided as an example only, and both redirect to

http://www.microsoft.com.)

The fix for this was to remove the functionality of the "usernameassword@" in urls for IE.

 

[bcastner]

http://www.broadbandreports.com/forum/remark,9275589~mode=flat

Believe me it is very cool being a new MS-MVP.

Best,
Bill Castner
MS-MVP