Internet Explorer Vulnerability - IMPORTANT

antonios_2

FYI : This website offers a test to check whether your browser is vulnerable to a phishing flaw

http://secunia.com/Internet_Explorer_Address_Bar_Spoofing_Vulnerability_Test/

Guess what !!! INTERNET EXPLORER MAY DISPLAY A LEGITIMATE ADDRESS WHILE YOU ARE VIEWING A WEBPAGE FROM A BOGUS WEBSITE

IE is totally vulnerable to this flaw!
I tested the same page with FIREFOX and everyhting was OK!!
Microsoft is still working on a patch....

You have been warned :money:
Cheers! :beer:

redux

I'm not sure IE is vulnerable to this so-called flaw. The secunia page is shown when they say it would be google - the back button goes to Google, so all they have done is call two sites up.

Are you sure about this information?

Dack

Yes it is a flaw. Yes IE is vulnerable. The flaw is a race condition exploit where you goto one page, setting the title and then using javascript open a second window.
Code from the secunia site is:

openWin('http://www.google.com/');

setTimeout("openWin('/19521_swf/?" + Math.random() + "');", 300);

setTimeout("openWin('/19521_swf_result/');", 2500);

As the example says you can think you are on one site and actually be somewhere completely different.

Also affects IE 7 beta 2 - doesn't affect Opera btw.

Also worth visiting http://bcheck.scanit.be/bcheck/ to see what holes are in your browser - no matter which one you've

Zeitgeist

The Browser Security Test is finished. Please find the results below:

High Risk Vulnerabilities 0
Medium Risk Vulnerabilities 0
Low Risk Vulnerabilities 0

I am running Internet Explorer. Hmm...

Dack

Yep - they stopped updating last year sometime - I discovered that after I'd posted the link - sorry. This means that the latest bunch of browser issues are not included.

Worth a visit to the secunia site to see what unpatched 'features' are in your browser - they sometimes include demonstration exploit code to test:

For Internet Explorer: http://secunia.com/product/11/
For Opera: http://secunia.com/product/4932/
For Firefox/Mozilla: http://secunia.com/product/4227/

MercilessKiller

redux wrote:

I'm not sure IE is vulnerable to this so-called flaw. The secunia page is shown when they say it would be google - the back button goes to Google, so all they have done is call two sites up.

Are you sure about this information?

Ye mate its a massive flaw.

Microsoft have confirmed it and say they're working on a patch...

Listen to the security Now podcast :P got it all on there