Web Proxy Auto-Discovery "Spoofing" May Change Proxy Settings (247333)
The information in this article applies to:
- Microsoft Internet Explorer 5.0 for Windows NT 4.0
- Microsoft Internet Explorer 5.0 for Windows 98
- Microsoft Internet Explorer 5.0 for Windows 95
This article was previously published under Q247333 SYMPTOMS
The Internet Explorer version 5 Web Proxy Auto-Discovery (WPAD) feature enables Web clients to automatically detect proxy settings without user intervention. The algorithm used by WPAD adds the subdomain "wpad" to the beginning of the fully-qualified domain name and progressively removes subdomains until it either finds a WPAD server answering the domain name or reaches the third-level domain. For example, Web clients in the a.b.microsoft.com domain would query wpad.a.b.microsoft, wpad.b.microsoft.com, and then wpad.microsoft.com. A vulnerability exists if the third-level domain is not a trusted domain. A malicious user could set up a WPAD server and serve proxy configuration commands of his or her choice.
CAUSE
WPAD is a feature introduced in Internet Explorer 5 that allows Web clients to find and load proxy configuration information from a server. The algorithm that determines the order in which domains are searched for this information may not handle some cases correctly.
RESOLUTIONTo resolve this problem, obtain the latest service pack for Internet Explorer version 5.01. For additional information, click the following article number to view the article in the
Microsoft Knowledge Base:
267954 How to Obtain the Latest Internet Explorer 5.01 Service Pack
On December 01, 1999, Microsoft released a security bulletin to the following web site announcing that Microsoft had released a version upgrade (Internet Explorer 5.01) that eliminates this vulnerability:
Microsoft has since become aware of a variant to this exploit that is not eliminated by Internet Explorer 5.01. On May 18, Microsoft released a comprehensive patch to eliminate this vulnerability (and three other vulnerabilities). For additional information about resolving this problem, click the article number below
to view the article in the Microsoft Knowledge Base:
262509 Patch Available for "Frame Domain Verification", "Unauthorized Cookie Access", "Malformed Component Attribute", and "WPAD Spoofing" Vulnerabilities
STATUSMicrosoft has confirmed that this is a problem in the Microsoft products that are listed at the beginning of this article. This problem was first corrected in Internet Explorer version 5.01 Service Pack 1.
| Modification Type: | Major | Last Reviewed: | 6/15/2004 |
|---|
| Keywords: | kbbug kbenv kbfix kbIE501preSP1fix kbie501sp1Fix KB247333 |
|---|
|