Design/Logic Flaw

2007-12-0511:46:00

PRIOn knowledge base

www.prio-n.com

7 High

AI Score

Confidence

Low

0.08 Low

EPSS

Percentile

94.3%

JSON

The Web Proxy Auto-Discovery (WPAD) feature in Microsoft Internet Explorer 6 and 7, when a primary DNS suffix with three or more components is configured, resolves an unqualified wpad hostname in a second-level domain outside this configured DNS domain, which allows remote WPAD servers to conduct man-in-the-middle (MITM) attacks.

CPENameOperatorVersion
internet_explorereq5.1 sp4
internet_explorereq6 sp1
internet_explorereq6
internet_explorereq7

Name	Operator	Version
internet_explorer	eq	5.1 sp4
internet_explorer	eq	6 sp1
internet_explorer	eq	6
internet_explorer	eq	7

References

secunia.com/advisories/27901

support.microsoft.com/kb/945713

www.microsoft.com/technet/security/advisory/945713.mspx

www.securityfocus.com/bid/26686

www.securitytracker.com/id?1019033

www.vupen.com/english/advisories/2007/4064