Microsoft Internet Explorer HTTPS Proxy Information Disclosure Vulnerability

2005-12-13T00:00:00
ID SMNTC-15825
Type symantec
Reporter Symantec Security Response
Modified 2005-12-13T00:00:00

Description

Description

Microsoft Internet Explorer is prone to an information disclosure vulnerability when using an authenticating proxy server for HTTPS communications. Exploitation of this issue could result in an attacker gaining a user's authentication credentials. This issue only exists when the authenticating proxy uses Basic Authentication.

Technologies Affected

  • Avaya DefinityOne Media Servers
  • Avaya DefinityOne Media Servers R10
  • Avaya DefinityOne Media Servers R11
  • Avaya DefinityOne Media Servers R12
  • Avaya DefinityOne Media Servers R6
  • Avaya DefinityOne Media Servers R7
  • Avaya DefinityOne Media Servers R8
  • Avaya DefinityOne Media Servers R9
  • Avaya IP600 Media Servers
  • Avaya IP600 Media Servers R10
  • Avaya IP600 Media Servers R11
  • Avaya IP600 Media Servers R12
  • Avaya IP600 Media Servers R6
  • Avaya IP600 Media Servers R7
  • Avaya IP600 Media Servers R8
  • Avaya IP600 Media Servers R9
  • Avaya Modular Messaging (MAS)
  • Avaya S8100 Media Servers
  • Avaya S8100 Media Servers R10
  • Avaya S8100 Media Servers R11
  • Avaya S8100 Media Servers R12
  • Avaya S8100 Media Servers R6
  • Avaya S8100 Media Servers R7
  • Avaya S8100 Media Servers R8
  • Avaya S8100 Media Servers R9
  • Avaya Unified Communications Center S3400
  • Microsoft Internet Explorer 5.0.1 SP4
  • Microsoft Internet Explorer 5.5 SP2
  • Microsoft Internet Explorer 6.0
  • Microsoft Internet Explorer 6.0 SP1

Recommendations

Communicate sensitive information through secure means.
Use strong authentication and encryption mechanisms for secure communications.

Microsoft has released fixes for supported operating system versions. Fixes for Internet Explorer 5.5 SP 2 running on Windows ME and Internet Explorer 6 SP 1 running on Windows 98/98SE/ME can be obtained through the Microsoft Update Web site or the Windows Update Web site. Avaya has released advisory ASA-2005-234 detailing affected Avaya products. Please see the referenced advisory for further information.