Check Point Advisories

Internet Explorer Status Bar URL Spoofing

Vulnerability
Protection

Check Point Reference:	CPAI-2004-195
Date Published:	18 Feb 2010
Severity:	Medium
Last Updated:	Thursday 18 February, 2010
Source:
Protection Provided by:	Security Gateway R81, R80, R77, R75
Who is Vulnerable?
Vulnerability Description	Internet Explorer (IE) is a popular web browser developed by the Microsoft corporation. Most of IE's functionality is dedicated to interpreting and rendering HyperText Markup Language (HTML) coded web pages. A vulnerability exists in the way Microsoft Internet Explorer displays a URL in the status bar. A specially crafted HTML link can be masqueraded in the status bar to an arbitrary URL. This can be used by an attacker to entice a user into visiting a malicious web page that, through masquerading, appears to be a trusted web page. The affected product will not exhibit any unusual behavior upon rendering HTML content containing the offending code.

Protection Overview

This protection will detect and block attempts to exploit this vulnerability.

In order for the protection to be activated, update your Security Gateway product to the latest IPS update. For information on how to update IPS, go to SBP-2006-05, click on Protection tab and select the version of your choice.

Security Gateway R80 / R77 / R75

In the IPS tab, click Protections and find the Internet Explorer Status Bar URL Spoofing protection using the Search tool and Edit the protection's settings.
Install policy on all Security Gateways.

This protection's log will contain the following information:

Attack Name: Web Client Enforcement Violation.
Attack Information: Microsoft Internet Explorer status bar URL spoofing