Secunia

Stefano Di Paola has reported some vulnerabilities in Internet Explorer, which can be exploited by malicious people to conduct HTTP request smuggling/splitting attacks.

The problem is that it is possible to modify certain headers via "setRequestHeader()", which can be exploited to e.g. inject arbitrary HTTP requests by setting the "Transfer-Encoding" header to "chunked" or to overwrite certain headers (e.g. "Content-Length", "Host", and "Referer").

The vulnerabilities are reported in version 7.0.5730.11. Other versions may also be affected.

Solution
Apply patches.
Further details available in Customer Area

Provided and/or discovered by
Stefano Di Paola

Changelog
Further details available in Customer Area

Original Advisory
MS08-031 (KB950759):
http://www.microsoft.com/technet/security/Bulletin/MS08-031.mspx

Stefano Di Paola:
http://www.mindedsecurity.com/MSA01240108.html
http://www.mindedsecurity.com/MSA02240108.html

Deep Links
Links available in Customer Area