http-equiv has discovered an issue in Microsoft Internet Explorer, Outlook and Outlook Express, allowing malicious people to obfuscate URLs.

The problem is that Internet Explorer, Outlook and Outlook Express fail to properly display the URL in the status bar if an image tag has been enclosed in a "A HREF" reference and uses a client side image map to specify the destination URL. This may cause a user to follow a link to a seemingly trusted website when in fact the browser opens a malicious website.

The issue has been confirmed in Outlook Express 6 and Internet Explorer 6 with all patches applied.

Reportedly, Outlook 2003 shows the correct URL.

NOTE: Phishing attacks exploiting this issue have been discovered in the wild.

Solution
The issue does not affect Windows XP systems with SP2 installed.
Further details available to Secunia VIM customers

Provided and/or discovered by
http-equiv

Changelog
Further details available to Secunia VIM customers

Deep Links
Links available to Secunia VIM customers