Old Flaw Haunts New Microsoft Browser
Security firm reports another glitch in newly released Internet Explorer 7.
Jeremy Kirk, IDG News Service
A security problem originally found in Microsoft
Internet Explorer 6 browser has returned to haunt IE7, the new version
of the browser launched two weeks ago, a security consultant said
Monday.
Danish security consultancy Secunia AsP posted an
advisory regarding an issue where an attacker could potentially snare
logins and passwords from an unsuspecting IE7 user. Over two years ago,
security researchers reported the same fault in IE6.
Misled by Pop-Ups
If
a user visits a Web site specially crafted by an attacker, and then
opens a "trusted" site such as a bank or e-commerce site that has a
pop-up window, the attacker can put new content into the pop-up, said
Thomas Kristensen, Secunia’s chief technology officer. This could
enable the attacker to ask a user for financial information or
passwords, he said.
When the problem was revealed in June 2004,
Microsoft gave instructions for a workaround for IE6: disable the
setting "Navigate sub-frames across different domains." That setting is
disabled by default in IE7, but does not appear to prevent the attack,
Kristensen said.
Microsoft has been notified of the flaw,
which was submitted to Secunia by a user, Kristensen said. Microsoft
officials did not have an immediate comment this morning.
Secunia
rated the problem as "moderately critical," but Kristensen said the
company was not aware of sites trying to exploit the flaw.
An
alert user might notice that they’re under attack: Since the URL for
the pop-up window is visible, it may be possible to identify a
fraudulent request for password information, for example. But "it would
require you to pay some attention to the address bar," Kristensen said.
However, a clever attacker could also use this problem in
combination with a pop-up spoofing weakness identified last week.
Microsoft hasn’t patched that problem.
Second IE7 Flaw
Following IE7’s release on October 18, Secunia found a problem it shared with IE6.
The
vulnerability allowed an attacker to potentially read information from
a secure Web site if the user had also opened a maliciously crafted Web
site. Microsoft said that the problem is actually in code called by the
browsers in another application, Outlook Express, which remains
unpatched.
http://www.pcworld.com/article/id,127703/article.html#
But I don’t need to worry about it, as Firefox’s programmers have a good understanding of what constitutes "security".
————————-
In backstory… finally got a message from Kym. Let’s just say that I hope she gets better soon; and until she gets better I can’t even have a non-speaking role in her life. Oh yes, it’s raining in my heart as well as outside. I’m going to log into KDE and change the background of Desktop 2 (sorry, I just thought I should say something that would slightly interest Linux users ;-) ).
Entries (RSS)