Web Proxy Auto-Discovery "Spoofing" May Change Proxy Settings

The Internet Explorer version 5 Web Proxy Auto-Discovery (WPAD) feature enables Web clients to automatically detect proxy settings without user intervention. The algorithm used by WPAD adds the subdomain "wpad" to the beginning of the fully-qualified domain name and progressively removes subdomains until it either finds a WPAD server answering the domain name or reaches the third-level domain. For example, Web clients in the a.b.microsoft.com domain would query wpad.a.b.microsoft, wpad.b.microsoft.com, and then wpad.microsoft.com. A vulnerability exists if the third-level domain is not a trusted domain. A malicious user could set up a WPAD server and serve proxy configuration commands of his or her choice.

WPAD is a feature introduced in Internet Explorer 5 that allows Web clients to find and load proxy configuration information from a server. The algorithm that determines the order in which domains are searched for this information may not handle some cases correctly.

To resolve this problem, obtain the latest service pack for Internet Explorer version 5.01. For additional information, click the following article number to view the article in the Microsoft Knowledge Base: On December 01, 1999, Microsoft released a security bulletin to the following web site announcing that Microsoft had released a version upgrade (Internet Explorer 5.01) that eliminates this vulnerability: Microsoft has since become aware of a variant to this exploit that is not eliminated by Internet Explorer 5.01. On May 18, Microsoft released a comprehensive patch to eliminate this vulnerability (and three other vulnerabilities). For additional information about resolving this problem, click the article number below to view the article in the Microsoft Knowledge Base:

Microsoft has confirmed that this is a problem in the Microsoft products that are listed at the beginning of this article. This problem was first corrected in Internet Explorer version 5.01 Service Pack 1.

For related information about this problem, please visit the following Microsoft Web site: For additional security-related information about Microsoft products, please visit the following Microsoft Web site: