In association with heise online

23 February 2007, 11:31

New phishing hole in Internet Explorer 7

  • Twitter
  • Facebook
  • submit to slashdot
  • StumbleUpon
  • submit to reddit

Michal Zalewski has discovered a vulnerability in Internet Explorer 7 that makes it easy for phishers to do their dirty work and takes the usual advice always to enter URLs manually to an absurd extreme. Just after Internet Explorer 7 was released last October, a flaw was detected that allows the address bar of a window to be incorrectly displayed.

Among other things, this new vulnerability is the result of the processing of what are called "onunload" events by JavaScript. For instance, a web site can prevent a new web site from being loaded even though the address of that new web site is displayed, provided the address is entered manually. Users then probably think they are on the right web site. Zalewski has provided a demo to allow people to test the flaw.

While victims still have to visit a malicious web site for an attack to succeed, once they have done so they cannot be sure that further web sites can be trusted. If, however, the next web site is visited via a bookmark, the address of the manipulated site is still displayed.

Secunia says that it discovered the hole on January 5 and reported it to Microsoft. The firm says that it wanted to wait to publish its own security advisory until Microsoft had provided its assessment. However, Secunia has now decided to release information because Zalewski has also done so. Internet Explorer 7 and Windows XP and Vista are affected.

While the problem does not affect Firefox, during his tests Zalewski found another flaw in the Mozilla Foundation's browser in the processing of onunload events that causes a crash. He has also published a demo to illustrate the problem. Zalewski says that he cannot rule out the possibility that code could be injected and executed through this hole given the nature of the flaw. As a workaround for both Firefox and Internet Explorer, the only thing users can do is switch off JavaScript to protect themselves.

Also see:


Print Version | Send by email | Permalink:

  • July's Community Calendar

The H Open

The H Security

The H Developer

The H Internet Toolkit