New IE flaw involves spoofed URLs

By Steve Malone

Posted on 1 Nov 2004 at 11:29

Security site BugTraq is reporting a new security flaw in fully patched versions of Internet Explorer 6.0. A simple piece of HTML will display a misleading destination URL in the status bar of fully patched Internet Explorer 6.0.2800.1106.

The problem arises because Internet Explorer misreads links surrounded by a table. For example in the code below

< a href="http://www.microsoft.com/"> <table> <tr> <td> <a href="http://www.pcpro.co.uk"> Click here</td> </tr> </table> </a>

By running the mouse over the link, the status bar reports www.microsoft.com when the link will actually take you to PC Pro.

The bug also extends to Microsoft Outlook Express. Other browsers are unaffected.

You can find more details at the BugTraq site.