Microsoft Investigates IE 7 Vulnerability

Mar 16, 2007
Internet Explorer logo

The vulnerability leaves users open to potential phishing attacks. Microsoft is investigating a new flaw uncovered in Internet Explorer 7 that opens users up to phishing attacks.

The vulnerability was discovered by noted Israel-based security researcher Aviv Raff. Using a cross-site scripting attack, an attacker can exploit a design flaw in IE 7, he wrote on his Web site.

He said an attacker can create a specially crafted navcancl.htm local resource link with a script that will display a fake content of a trusted site such as PayPal.

When the victim opens the link that was sent by the attacker, a "Navigation Canceled" page will be displayed, he said.

If the victim refreshes the page, the attacker's provided content - a fake PayPal login page for example - will be displayed in an attempt to trick the user into believing he or she is on the actual site, he wrote.

In an interview with eWEEK, Raff said the vulnerability should be taken seriously.

"Well, it's a serious threat, because a phisher can use it to take advantage of his victim without the need to create a fake URL," he said.

"Until MS fixes this vulnerability, the user should not trust the "Navigation Canceled" page, and should not click on any link on that page."

The vulnerability affects IE 7 on Windows Vista and XP.

A Microsoft spokesperson said in an e-mail to eWEEK the company was not aware of anyone actually trying to exploit the vulnerability.

The company will continue to investigate the matter and will take appropriate action when the investigation is completed, and urged anyone who feels that have been affected to contact Product Support Services.

Copyright 2007 by Ziff Davis Media, Distributed by United Press International

Explore further: Fans hop aboard exclusive train to Comic-Con

add to favorites email to friend print save as pdf

Related Stories

Security experts raise flags over WhatsApp

Feb 22, 2014

The Facebook deal for WhatsApp drew attention for its whopping price tag, but has also brought out fresh criticism over security for the billions of messages delivered on the platform.

Retail breaches could fuel push for safer cards

Jan 17, 2014

The Target credit and debit card and personal information breach, which last week was revealed to have affected more consumers than originally thought and which may be linked to attacks on other retailers, is expected to ...

Study cites 'dangerous weak link' in nuke security

Jan 08, 2014

The number of countries possessing the makings of a nuclear bomb has dropped by almost one-quarter over the past two years, but there remain "dangerous weak links" in nuclear materials security that could be exploited by ...

Recommended for you

Google worker shows early-draft glimpse of Chrome OS

Jul 20, 2014

The Chrome OS is in for a future look. Athena, a Chromium OS project, will bring forth the new Chrome OS user experience. Google's François Beaufort on Friday, referring to the screenshot he posted, said," ...

Google eyes Chrome on Windows laptop battery drain

Jul 19, 2014

Google Chrome on Microsoft Windows has been said to have a problem for some time but this week comes news that Google will give it the attention others think the problem quite deserves. Namely, Google is to ...

User comments : 0