Microsoft Investigates IE 7 Vulnerability
March 16, 2007
The vulnerability leaves users open to potential phishing attacks. Microsoft is investigating a new flaw uncovered in Internet Explorer 7 that opens users up to phishing attacks.
The vulnerability was discovered by noted Israel-based security researcher Aviv Raff. Using a cross-site scripting attack, an attacker can exploit a design flaw in IE 7, he wrote on his Web site.
He said an attacker can create a specially crafted navcancl.htm local resource link with a script that will display a fake content of a trusted site such as PayPal.
When the victim opens the link that was sent by the attacker, a "Navigation Canceled" page will be displayed, he said.
If the victim refreshes the page, the attacker's provided content - a fake PayPal login page for example - will be displayed in an attempt to trick the user into believing he or she is on the actual site, he wrote.
In an interview with eWEEK, Raff said the vulnerability should be taken seriously.
"Well, it's a serious threat, because a phisher can use it to take advantage of his victim without the need to create a fake URL," he said.
"Until MS fixes this vulnerability, the user should not trust the "Navigation Canceled" page, and should not click on any link on that page."
The vulnerability affects IE 7 on Windows Vista and XP.
A Microsoft spokesperson said in an e-mail to eWEEK the company was not aware of anyone actually trying to exploit the vulnerability.
The company will continue to investigate the matter and will take appropriate action when the investigation is completed, and urged anyone who feels that have been affected to contact Product Support Services.
Copyright 2007 by Ziff Davis Media, Distributed by United Press International
-
Science panel: Get ready for extreme weather (Update)
Nov 18, 2011 |
3.3 / 5 (4) |
10
-
An invitation to crime: How a friendly click can compromise a company
Mar 13, 2010 |
4.6 / 5 (16) |
3
-
Microsoft warns of serious computer security hole
Jul 06, 2009 |
4.5 / 5 (12) |
11
-
System thwarts Internet eavesdropping
Aug 25, 2008 |
4.6 / 5 (16) |
0
-
Microsoft to Upgrade Patch Advance Notice and Bulletins
May 17, 2007 |
1 / 5 (1) |
0
-
Engineers build first sub-10-nm carbon nanotube transistor
Feb 01, 2012 |
4.9 / 5 (31) |
30
-
Something old, something new: Evolution and the structural divergence of duplicate genes
Jan 31, 2012 |
4.6 / 5 (7) |
1
-
The hidden nanoworld of ice crystals: Revealing the dynamic behavior of quasi-liquid layers
Jan 30, 2012 |
5 / 5 (3) |
1
-
Stock market network reveals investor clustering
Jan 27, 2012 |
3.9 / 5 (23) |
8
-
Of microchemistry and molecules: Electronic microfluidic device synthesizes biocompatible probes
Jan 26, 2012 |
5 / 5 (1) |
0
-
A way to send and receive wireless data
2 hours ago
-
Tabletop Cold Fusion Reactor
3 hours ago
-
Calling function with no input argument
Feb 10, 2012
-
Force free body diagram problem on gym equipment
Feb 10, 2012
-
Empirical data regarding shower heads and water
Feb 10, 2012
-
feed hold button on CNC lathe
Feb 09, 2012
- More from Physics Forums - General Engineering
More news stories
Walney offshore wind farm is world's biggest (for now)
(PhysOrg.com) -- The Walney wind farm on the Irish Sea--characterized by high tides, waves and windy weather--officially opened this week. The farm is treated in the press as a very big deal as the Walney ...
Europeans protest controversial Internet pact
Tens of thousands of people marched in protests in more than a dozen European cities Saturday against a controversial anti-online piracy pact that critics say could curtail Internet freedom.
1 hour ago |
not rated yet |
0
GPS court ruling leaves US phone tracking unclear
A US Supreme Court decision requiring a warrant to place a GPS device on the car of a criminal suspect leaves unresolved the bigger issue of police tracking using mobile phones, legal experts say.
5 hours ago |
4 / 5 (1) |
0
Anonymous briefly knocks CIA website offline (Update 2)
The website of the Central Intelligence Agency was briefly inaccessible on Friday after the hacker group Anonymous claimed to have knocked it offline.
22 hours ago |
4.7 / 5 (14) |
24
Netflix settlement trims 14 pct off 4Q earnings
(AP) -- Netflix pressed the rewind button on its fourth-quarter earnings after settling allegations that the video subscription service violated a consumer-privacy law.
5 hours ago |
not rated yet |
0
Study finds that anti-diabetic medication can prevent the long-term effects of maternal obesity
In a study to be presented today at the Society for Maternal-Fetal Medicine's annual meeting, The Pregnancy Meeting, in Dallas, Texas, researchers will report findings that show that short therapy with the anti-diabetic medication ...
Europe stakes billion-dollar bet on new rocket
A pencil-slim rocket is scheduled to lift into space from South America on Monday, carrying a billion-dollar bet that Europe can grab a juicy slice of the market to place satellites in low orbit.
Steroid injections prove effective in treatment of lumbar disc herniations
The use of epidural steroid injections may be a more efficient treatment option for lumbar disc herniations, according to research presented today at the American Orthopaedic Society for Sports Medicine's Specialty Day in ...
Amateur football players not always keen on returning to play after ACL injuries
Despite the known success rates of reconstructive Anterior Cruciate Ligament (ACL) surgery, the number of high school and collegiate football players returning to play may not be as high as anticipated, say researchers presenting ...
Study finds elevated levels of cell-free DNA in first trimester do not predict preeclampsia
In a study to be presented today at the Society for Maternal-Fetal Medicine's annual meeting, The Pregnancy Meeting, in Dallas, Texas, researchers will report findings that indicate that elevated levels of cell-free DNA in ...
PRP treatment aids healing of elbow injuries say researchers
As elbow injuries continue to rise, especially in pitchers, procedures to help treat and get players back in the game quickly have been difficult to come by. However, a newer treatment called platelet rich plasma (PRP) may ...