Browser spoofing flaw discovered in Internet Explorer 7

By

The latest version of Internet Explorer is susceptible to a zero-day vulnerability that can permit a malicious website to spoof the address bar, a security researcher reported this weekend.

Browser spoofing flaw discovered in Internet Explorer 7
The "less critical" flaw, according to tracking firm Secunia, is caused by an error in the processing of the "document.open()" method, used to open a new window and load documents as specified by a URL.

In the case of this vulnerability, users visiting a malicious website who try to navigate off the site – by manually entering a new URL – are brought to a compromised webpage hosted by the attacker even though the address bar shows them to be at the legitimate site they requested.

"Microsoft's (IE) seems to have a soft spot for browser entrapment vulnerabilities," discovering researcher Michal Zalewski said on the Full Disclosure mailing list.

"Just to recap, in these attacks, the user is made (to) believe he had left a webpage…but in reality, is prevented from doing so, and his browser continues to display content originating from the attacker."

In lieu of a patch, users are advised to close the windows of untrusted websites, according to today’s Secunia advisory.

The flaw, which requires JavaScript to run, was not tested in IE6, said Zalewski, who posted a demonstration of the attack.

Microsoft is investigating claims of the vulnerability and is not aware of any public exploits, a company spokesman told SCMagazine.com in an email.
Got a news tip for our journalists? Share it with us anonymously here.
Tags:

Most Read Articles

Qantas facing 'significant' data theft after cyber attack

Qantas facing 'significant' data theft after cyber attack

Home Affairs officer accessed data on "friends and associates"

Home Affairs officer accessed data on "friends and associates"

International Criminal Court hit by cyber attack

International Criminal Court hit by cyber attack

Ex-student charged over Western Sydney University cyberattacks

Ex-student charged over Western Sydney University cyberattacks

Log In

  |  Forgot your password?