Microsoft KB Archive/306121

= MS01-051: Malformed &quot;Dotless&quot; IP Address Can Cause a Web Page to Be Handled in the Intranet Zone =

Article ID: 306121

Article Last Modified on 1/31/2007

-

APPLIES TO


 * Microsoft Internet Explorer 5.5 Service Pack 1
 * Microsoft Internet Explorer 5.5 Service Pack 2
 * Microsoft Internet Explorer 5.01
 * Microsoft Internet Explorer 5.01
 * Microsoft Internet Explorer 5.5 Service Pack 1
 * Microsoft Internet Explorer 5.5 Service Pack 2
 * Microsoft Internet Explorer 5.5 Service Pack 1
 * Microsoft Internet Explorer 5.5 Service Pack 2
 * Microsoft Internet Explorer 5.01
 * Microsoft Internet Explorer 5.01
 * Microsoft Internet Explorer 5.5 Service Pack 1
 * Microsoft Internet Explorer 5.5 Service Pack 2
 * Microsoft Internet Explorer 5.01
 * Microsoft Internet Explorer 5.01
 * Microsoft Internet Explorer 5.5
 * Microsoft Internet Explorer 5.5
 * Microsoft Internet Explorer 5.01
 * Microsoft Internet Explorer 5.01
 * Microsoft Internet Explorer 5.5 Service Pack 1
 * Microsoft Internet Explorer 5.5 Service Pack 2
 * Microsoft Internet Explorer 5.01
 * Microsoft Internet Explorer 5.01
 * Microsoft Internet Explorer 6.0
 * Microsoft Internet Explorer 6.0
 * Microsoft Internet Explorer 6.0
 * Microsoft Internet Explorer 6.0
 * Microsoft Internet Explorer 6.0
 * Microsoft Internet Explorer 6.0

-



This article was previously published under Q306121



SYMPTOMS
A vulnerability exists in Internet Explorer that could allow a Web site to take actions that it should not be able to take when you visit the Web site. Specifically, the vulnerability could allow the Web site to trick Internet Explorer into treating the page as though it were located on your intranet, thereby gaining the ability to use less-restrictive security settings than are appropriate. You could be affected by this vulnerability either by surfing to an attacker's Web site or by opening an HTML e-mail message from an attacker.

If the security settings are left in their default states, the additional privileges that the Web site would gain would still not allow the page to take any destructive action. The greater danger from this vulnerability occurs if you have given intranet sites additional latitude.

NOTE: The problem that is described in this article does not apply to Internet Explorer 6. However, the patch to which this article links also resolves two other problems that do affect Internet Explorer 6. If you are running Internet Explorer 6, you should apply this patch to resolve the two other issues.

For additional information about the two issues in Internet Explorer 6 that are resolved by the patch, click the article numbers below to view the articles in the Microsoft Knowledge Base:

286043 Patch Available for Telnet Logging Vulnerability

308414 Patch Available for HTTP Request Encoding Vulnerability



CAUSE
This vulnerability results because it is possible to refer to a Web site by using a particular type of &quot;dotless&quot; IP address. This causes Internet Explorer to handle the site in the Local Intranet zone rather than the correct zone.



Internet Explorer 5.5
A supported fix is now available from Microsoft, but it is only intended to correct the problem that is described in this article. Apply it only to computers that you determine are at risk of attack. Evaluate your computer's physical accessibility, network and Internet connectivity, and other factors to determine the degree of risk to your computer. See the associated Microsoft Security Bulletin to help determine the degree of risk. This fix may receive additional testing. If your computer is sufficiently at risk, Microsoft recommends that you apply this fix now. Otherwise, wait for the next Internet Explorer 5.5 service pack that contains this fix.

To resolve this problem immediately, download the fix by following the instructions later in this article or contact Microsoft Product Support Services to obtain the fix. For a complete list of Microsoft Product Support Services phone numbers and information about support costs, visit the following Microsoft Web site:

http://support.microsoft.com/default.aspx?scid=fh;EN-US;CNTACTMS

NOTE: In special cases, charges that are ordinarily incurred for support calls may be canceled if a Microsoft Support Professional determines that a specific update will resolve your problem. The usual support costs will apply to additional support questions and issues that do not qualify for the specific update in question.

The &quot;Security Update, December 13, 2001&quot; patch is superseded by the following patch:

316059 MS02-005: February 11, 2002, Cumulative Patch for Internet Explorer

The &quot;Security Update, December 13, 2001&quot; patch is available at the following Microsoft Web site:

http://www.microsoft.com/windows/ie/downloads/critical/q313675/default.asp

Internet Explorer 5.01
The &quot;Security Update, October 10, 2001&quot; patch is superseded by the following patches:

316059 MS02-005: February 11, 2002, Cumulative Patch for Internet Explorer

311401 Windows 2000 Security Rollup Package 1 (SRP1), January 2002

The &quot;Security Update, October 10, 2001&quot; patch is available at the following Microsoft Web site:

http://www.microsoft.com/windows/ie/downloads/critical/q306121/default.asp

Internet Explorer 5.01 for Windows 2000
To resolve this problem, obtain the latest service pack for Internet Explorer 5.01 for Windows 2000. For additional information, click the following article number to view the article in the Microsoft Knowledge Base:

267954 How to Obtain the Latest Internet Explorer 5.01 Service Pack



Internet Explorer 5.5
Microsoft has confirmed that this problem may cause a degree of security vulnerability in Internet Explorer 5.5.

Internet Explorer 5.01
Microsoft has confirmed that this problem may cause a degree of security vulnerability in Internet Explorer 5.01. This problem was first corrected in Internet Explorer 5.01 for Windows 2000 Service Pack 3.



MORE INFORMATION
For more information about this vulnerability, visit the following Microsoft Web site:

http://www.microsoft.com/technet/security/bulletin/ms01-051.mspx

You can download the patch for Internet Explorer version 6 from the following Microsoft Web site:

http://www.microsoft.com/windows/ie/downloads/critical/q306121/download.asp

Additional query words: security_patch patch20 Spoofing Telnet Invocation HTTP Request Encoding kbWin2000SRP1

Keywords: kbbug kbfix kbie501presp3fix kbsecvulnerability kbwin2000sp3fix kbsecurity kbie550presp3fix kbsecbulletin kbsechack KB306121

-

[mailto:TECHNET@MICROSOFT.COM Send feedback to Microsoft]

© Microsoft Corporation. All rights reserved.