Microsoft Investigates IE 7 Vulnerability

Mar 16, 2007
Internet Explorer logo

The vulnerability leaves users open to potential phishing attacks. Microsoft is investigating a new flaw uncovered in Internet Explorer 7 that opens users up to phishing attacks.

The vulnerability was discovered by noted Israel-based security researcher Aviv Raff. Using a cross-site scripting attack, an attacker can exploit a design flaw in IE 7, he wrote on his Web site.

He said an attacker can create a specially crafted navcancl.htm local resource link with a script that will display a fake content of a trusted site such as PayPal.

When the victim opens the link that was sent by the attacker, a "Navigation Canceled" page will be displayed, he said.

If the victim refreshes the page, the attacker's provided content - a fake PayPal login page for example - will be displayed in an attempt to trick the user into believing he or she is on the actual site, he wrote.

In an interview with eWEEK, Raff said the vulnerability should be taken seriously.

"Well, it's a serious threat, because a phisher can use it to take advantage of his victim without the need to create a fake URL," he said.

"Until MS fixes this vulnerability, the user should not trust the "Navigation Canceled" page, and should not click on any link on that page."

The vulnerability affects IE 7 on Windows Vista and XP.

A Microsoft spokesperson said in an e-mail to eWEEK the company was not aware of anyone actually trying to exploit the vulnerability.

The company will continue to investigate the matter and will take appropriate action when the investigation is completed, and urged anyone who feels that have been affected to contact Product Support Services.

Copyright 2007 by Ziff Davis Media, Distributed by United Press International

Explore further: Linux distrib vendors make patches available for GHOST

add to favorites email to friend print save as pdf

Related Stories

Recommended for you

Sheriffs expand concerns about Waze mobile traffic app

15 hours ago

A law enforcement campaign to compel Google Inc. to disable a feature in its popular Waze traffic app that lets drivers warn others about nearby police activity shifted Wednesday when a sheriffs' organization ...

Mobile apps take students into the laboratory

19 hours ago

Mobile apps have proved to be valuable educational tools, but laboratory instructors thus far have been limited to using mobile devices only for virtual laboratories with simulated experiments. Now, researchers ...

Google's Waze app endangers police: LAPD chief

Jan 28, 2015

Google's newly acquired Waze application poses a danger to police because of its ability to track their locations, the Los Angeles police chief said in a letter to the tech company's CEO.

Catch the northern lights with your mobile

Jan 26, 2015

Updates on the best opportunities to spot the Northern Lights in the UK are now available on a mobile phone app developed in association with scientists at Lancaster University.

User comments : 0

Please sign in to add a comment. Registration is free, and takes less than a minute. Read more

Click here to reset your password.
Sign in to get notified via email when new comments are made.