New IE flaw allows address bar spoofing

By

Another Internet Explorer (IE) flaw has been found, one that allows phishers and other malicious users to spoof an address bar when creating a malicious site.

The vulnerability is caused by a condition in the loading of Macromedia Flash Format (.swf) files in browser windows. The flaw can then be exploited to show what appears to be a legitimate address bar, according to vulnerability monitoring firm Secunia.


The firm also provided a test for home users to see if their browsers have been affected by this flaw.

The flaw, called "moderately critical" by Secunia, was confirmed on a fully patched system with IE 6 and Windows XP service packs 1 and 2.

Users should disable active scripting support to avoid the flaw affecting their systems, according to Secunia.

Microsoft researchers have been working on a patch for a recently discovered createTextRange() flaw in IE. Company officials have hinted the fix will be a part of next week's Patch Tuesday release.

In January, Microsoft released a rare out-of-cycle patch for the much hyped Windows metafile (WMF) vulnerability, which received widespread media attention in the early days of this year.

Got a news tip for our journalists? Share it with us anonymously here.
Copyright © SC Magazine, US edition
Tags:

Most Read Articles

India's alarm over Chinese spying rocks CCTV makers

India's alarm over Chinese spying rocks CCTV makers

Hackers abuse modified Salesforce app to steal data, extort companies

Hackers abuse modified Salesforce app to steal data, extort companies

Woolworths' CSO is Optus-bound

Woolworths' CSO is Optus-bound

Cyber companies hope to untangle weird hacker codenames

Cyber companies hope to untangle weird hacker codenames

Log In

  |  Forgot your password?