Phishing using IE7 local resource vulnerability

Summary
Internet Explorer 7.0 is vulnerable to cross-site scripting in one of its local resources. In combination with a design flaw in this specific local resource it is possible for an attacker to easily conduct phishing attacks against IE7 users.

Affected versions
• Windows Vista - Internet Explorer 7.0
• Windows XP - Internet Explorer 7.0

Proof-of-Concept is available

Workaround / Suggestion
Until Microsoft fixes this vulnerability, do not trust the “Navigation Canceled” page.

http://aviv.raffon.net/2007/03/14/PhishingUsingIE7LocalResourceVulnerability.aspx

Published Wed, Mar 14 2007 18:09 by donna

Comments

Wednesday, March 14, 2007 1:09 PM by Windows Security Blogs » Blog Archive » Phishing using IE7 local resource vulnerability

# Windows Security Blogs » Blog Archive » Phishing using IE7 local resource vulnerability

PingBack from http://winblogs.security-feed.com/2007/03/14/phishing-using-ie7-local-resource-vulnerability-2/