IE browser bug looks kind of familiar
Secunia spots a problem in 7 that lurked for years in 6
Jeremy Kirk
October 30, 2006 (IDG News Service) — A security problem originally found in Microsoft Corp.’s Internet Explorer 6 browser has returned to haunt IE7, the new version of the browser launched two weeks ago, a security consultant said Monday.
Danish security consultancy Secunia AsP posted an advisory regarding an issue where an attacker could potentially snare logins and passwords from an unsuspecting IE7 user. Over two years ago, security researchers reported the same fault in IE6.
If a user visits a Web site specially crafted by an attacker, and then opens a “trusted” site such as a bank or e-commerce site that has a pop-up window, the attacker can put new content into the pop-up, said Thomas Kristensen, Secunia’s chief technology officer. This could enable the attacker to ask a user for financial information or passwords, he said.
When the problem was revealed in June 2004, Microsoft gave instructions for a workaround for IE6: disable the setting “Navigate sub-frames across different domains.” That setting is disabled by default in IE7, but does not appear to prevent the attack, Kristensen said.
Microsoft has been notified of the flaw, which was submitted to Secunia by a user, Kristensen said. Microsoft officials did not have an immediate comment on Monday morning. [Link]