Description
The Web Proxy Auto-Discovery (WPAD) feature in Microsoft Internet Explorer 6 and 7, when a primary DNS suffix with three or more components is configured, resolves an unqualified wpad hostname in a second-level domain outside this configured DNS domain, which allows remote WPAD servers to conduct man-in-the-middle (MITM) attacks.
References (6)
Core 6
Core References
Vendor Advisory x_refsource_confirm
http://www.microsoft.com/technet/security/advisory/945713.mspx
Third Party Advisory vdb-entry
x_refsource_vupen
http://www.vupen.com/english/advisories/2007/4064
Third Party Advisory, VDB Entry vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/26686
Third Party Advisory, VDB Entry vdb-entry
x_refsource_sectrack
http://www.securitytracker.com/id?1019033
Vendor Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/27901
Vendor Advisory vendor-advisory
x_refsource_mskb
http://support.microsoft.com/kb/945713
Scores
EPSS
0.1663
EPSS Percentile
96.7%
Details
Status
published
Products (3)
microsoft/internet_explorer
5.01 sp4
microsoft/internet_explorer
6 sp1 (2 CPE variants)
microsoft/internet_explorer
7
Published
Dec 05, 2007
Tracked Since
Feb 18, 2026