VULHUB ™

IE5's automatic proxy configuration feature, WPAD, (Web Proxy Auto-Discovery) can be fooled into using or attempting to use a non-authorized server as a proxy server. An attacker on a different network could use this to read web traffic from the IE5 client. IE5 will search for a WPAD server by looking for machines named wpad.x.x.x in the current domain. If none is found, it will proceed up the domain name structure, until it gets to the third-level domain name. For example, IE5 running on host a.b.c.d.net would first look for wpad.b.c.d.net, then wpad.c.d.net, then wpad.d.net. In certain network configurations, the third-level domain is not neccessarily a trusted part of the network, and an attacker could set up a server to cause IE5 clients to use a hostile machine as proxy.

IE5's automatic proxy configuration feature, WPAD, (Web Proxy Auto-Discovery) can be fooled into using or attempting to use a non-authorized server as a proxy server. An attacker on a different network could use this to read web traffic from the IE5 client. IE5 will search for a WPAD server by looking for machines named wpad.x.x.x in the current domain. If none is found, it will proceed up the domain name structure, until it gets to the third-level domain name. For example, IE5 running on host a.b.c.d.net would first look for wpad.b.c.d.net, then wpad.c.d.net, then wpad.d.net. In certain network configurations, the third-level domain is not neccessarily a trusted part of the network, and an attacker could set up a server to cause IE5 clients to use a hostile machine as proxy.