National Cyber Awareness System

Vulnerability Summary for CVE-2006-1626

Overview

Internet Explorer 6 for Windows XP SP2 and earlier allows remote attackers to spoof the address bar and possibly conduct phishing attacks by re-opening the window to a malicious Shockwave Flash application, then changing the window location back to a trusted URL while the Flash application is still loading. NOTE: this is a different vulnerability than CVE-2006-1192.

Impact

CVSS Severity (version 2.0):

CVSS Version 2 Metrics:

Solution

This vulnerability affects any version of Windows OS previous to XP SP2 that is using Internet Explorer 6.0}

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

External Source: XF

Name: ie-swf-addressbar-spoofing(25634)

Hyperlink:http://xforce.iss.net/xforce/xfdb/25634

External Source: VUPEN

Name: ADV-2006-2319

Type: Advisory

Hyperlink:http://www.vupen.com/english/advisories/2006/2319

External Source: VUPEN

Name: ADV-2006-1218

Hyperlink:http://www.vupen.com/english/advisories/2006/1218

External Source: BID

Name: 17404

Hyperlink:http://www.securityfocus.com/bid/17404

External Source: BUGTRAQ

Name: 20060721 about bid 17404

Hyperlink:http://www.securityfocus.com/archive/1/archive/1/440851/100/100/threaded

External Source: BUGTRAQ

Name: 20060404 Another way to spoof Internet Explorer Address Bar

Hyperlink:http://www.securityfocus.com/archive/1/archive/1/429891/100/0/threaded

External Source: BUGTRAQ

Name: 20060403 Another Internet Explorer Address Bar Spoofing Vulnerability

Type: Advisory; Exploit

Hyperlink:http://www.securityfocus.com/archive/1/archive/1/429719/100/0/threaded

External Source: MS

Name: MS06-021

Hyperlink:http://www.microsoft.com/technet/security/bulletin/ms06-021.mspx

External Source: SECTRACK

Name: 1016291

Hyperlink:http://securitytracker.com/id?1016291

External Source: MISC

Name: http://secunia.com/Internet_Explorer_Address_Bar_Spoofing_Vulnerability_Test/

Type: Advisory

Hyperlink:http://secunia.com/Internet_Explorer_Address_Bar_Spoofing_Vulnerability_Test/

External Source: SECUNIA

Name: 19521

Type: Advisory; Exploit

Hyperlink:http://secunia.com/advisories/19521

US Government Resource: oval:org.mitre.oval:def:1918

Name: oval:org.mitre.oval:def:1918

Type: Tool Signature

Hyperlink:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:1918

US Government Resource: oval:org.mitre.oval:def:1881

Name: oval:org.mitre.oval:def:1881

Type: Tool Signature

Hyperlink:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:1881

US Government Resource: oval:org.mitre.oval:def:1842

Name: oval:org.mitre.oval:def:1842

Type: Tool Signature

Hyperlink:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:1842

US Government Resource: oval:org.mitre.oval:def:1806

Name: oval:org.mitre.oval:def:1806

Type: Tool Signature

Hyperlink:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:1806

US Government Resource: oval:org.mitre.oval:def:1604

Name: oval:org.mitre.oval:def:1604

Type: Tool Signature

Hyperlink:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:1604

US Government Resource: oval:org.mitre.oval:def:1600

Name: oval:org.mitre.oval:def:1600

Type: Tool Signature

Hyperlink:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:1600

References to Check Content

Identifier:oval:org.mitre.oval:def:1604

Check System:http://oval.mitre.org/XMLSchema/oval-definitions-5

Hyperlink:http://oval.mitre.org/repository/data/DownloadDefinition?id=oval:org.mitre.oval:def:1604

Identifier:oval:org.mitre.oval:def:1600

Check System:http://oval.mitre.org/XMLSchema/oval-definitions-5

Hyperlink:http://oval.mitre.org/repository/data/DownloadDefinition?id=oval:org.mitre.oval:def:1600

Identifier:oval:org.mitre.oval:def:1881

Check System:http://oval.mitre.org/XMLSchema/oval-definitions-5

Hyperlink:http://oval.mitre.org/repository/data/DownloadDefinition?id=oval:org.mitre.oval:def:1881

Identifier:oval:org.mitre.oval:def:1918

Check System:http://oval.mitre.org/XMLSchema/oval-definitions-5

Hyperlink:http://oval.mitre.org/repository/data/DownloadDefinition?id=oval:org.mitre.oval:def:1918

Identifier:oval:org.mitre.oval:def:1806

Check System:http://oval.mitre.org/XMLSchema/oval-definitions-5

Hyperlink:http://oval.mitre.org/repository/data/DownloadDefinition?id=oval:org.mitre.oval:def:1806

Identifier:oval:org.mitre.oval:def:1842

Check System:http://oval.mitre.org/XMLSchema/oval-definitions-5

Hyperlink:http://oval.mitre.org/repository/data/DownloadDefinition?id=oval:org.mitre.oval:def:1842