New IE flaw allows address bar spoofing

By on

Another Internet Explorer (IE) flaw has been found, one that allows phishers and other malicious users to spoof an address bar when creating a malicious site.

The vulnerability is caused by a condition in the loading of Macromedia Flash Format (.swf) files in browser windows. The flaw can then be exploited to show what appears to be a legitimate address bar, according to vulnerability monitoring firm Secunia.

The firm also provided a test for home users to see if their browsers have been affected by this flaw.

The flaw, called "moderately critical" by Secunia, was confirmed on a fully patched system with IE 6 and Windows XP service packs 1 and 2.

Users should disable active scripting support to avoid the flaw affecting their systems, according to Secunia.

Microsoft researchers have been working on a patch for a recently discovered createTextRange() flaw in IE. Company officials have hinted the fix will be a part of next week's Patch Tuesday release.

In January, Microsoft released a rare out-of-cycle patch for the much hyped Windows metafile (WMF) vulnerability, which received widespread media attention in the early days of this year.

Copyright © SC Magazine, US edition
Tags:

Most Read Articles

Log In

Username:
Password:
|  Forgot your password?