CVE-2004-2219

Vulnerability

Microsoft Internet Explorer 6 allows remote attackers to spoof the address bar to facilitate phishing attacks via JavaScript that uses an invalid URI, modifies the Location field, then uses history.back to navigate to the previous domain, aka NullyFake [1]. Versions prior to the fix are affected.

Exploitation

An attacker can craft a malicious web page that, when visited by a user, runs JavaScript that first sets an invalid URI (e.g., using "javascript:" or similar), modifies the Location field to a fraudulent URL, and then calls history.back to return to the previous domain. The address bar then displays the spoofed URL while the page content is from the attacker’s site [1]. No authentication or user interaction beyond visiting the page is required.

Impact

Successful exploitation allows the attacker to spoof the address bar, making a malicious website appear as a legitimate one. This facilitates phishing attacks by deceiving users into believing they are on a trusted site, potentially leading to disclosure of sensitive information [1].

Mitigation

Microsoft has released a security update for Internet Explorer 6 that addresses this vulnerability. Users should apply the latest updates from Windows Update [1]. No workaround is provided in the available references.