IE7 Bug Reported: May Aid Phishers

[engine]

A vulnerability in Microsoft Corp.'s Internet Explorer (IE) browser could help fraudsters make phishing Web sites appear legitimate, a security researcher reported Wednesday.

The flaw lies in the way IE7 processes a locally stored HTML (Hypertext Markup Language) error message page that is typically shown when the user cancels the loading of a Web page, said Aviv Raff, a security researcher based in Israel.

IE7 Bug Reported: May Aid Phishers [news.yahoo.com]

[phranque]

< This message was moved from another location >

from CNET News.com [news.com.com]:

Microsoft is investigating a possible vulnerability in Internet Explorer 7 that could help cybercrooks launch phishing scams, the company said Wednesday.
...
The vulnerability relates to the message IE displays when Web page loading is aborted, Raff wrote. An attacker can rig the message by creating a malicious link. The message will offer a link to retry loading the page; hitting it brings up the attacker's page, but showing an arbitrary Web address, he wrote.

[edited by: tedster at 8:05 am (utc) on Mar. 15, 2007]