Apache-Talk @lexa.ru 

Inet-Admins @info.east.ru 

Filmscanners @halftone.co.uk 

Security-alerts @yandex-team.ru 

nginx-ru @sysoev.ru 

   


   


   

















      :: Security-alerts
Security-Alerts mailing list archive (security-alerts@yandex-team.ru)

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

[security-alerts] FW: [SA26069] Internet Explorer "document.open()" Method Spoofing Vulnerability



>
> TITLE:
> Internet Explorer "document.open()" Method Spoofing Vulnerability
>
> SECUNIA ADVISORY ID:
> SA26069
>
> VERIFY ADVISORY:
> http://secunia.com/advisories/26069/
>
> CRITICAL:
> Less critical
>
> IMPACT:
> Spoofing
>
> WHERE:
> From remote
>
> SOFTWARE:
> Microsoft Internet Explorer 7.x
> http://secunia.com/product/12366/
>
> DESCRIPTION:
> Michal Zalewski has discovered a vulnerability in Internet Explorer,
> which can be exploited by a malicious website to spoof the address
> bar.
>
> The vulnerability is caused due to an error in the handling of the
> "document.open()" method and can be exploited to spoof the address
> bar if e.g. the user enters a new website manually in the address
> bar, which is commonly exercised as best practice.
>
> The vulnerability is confirmed on a fully patched Windows XP SP2
> system running Internet Explorer 7. Other versions may also be
> affected.
>
> SOLUTION:
> Close all browser windows after visiting untrusted websites.
>
> PROVIDED AND/OR DISCOVERED BY:
> Michal Zalewski
>
> ORIGINAL ADVISORY:
> http://lists.grok.org.uk/pipermail/full-disclosure/2007-July/0
> 64636.html
>



 




Copyright © Lexa Software, 1996-2009.