[security-alerts] FW: [SA26069] Internet Explorer "document.open()" Method Spoofing Vulnerability

["Kazennov, Vladimir" <Vladimir.Kazennov@xxxxxxxxxx>]

>
> TITLE:
> Internet Explorer "document.open()" Method Spoofing Vulnerability
>
> SECUNIA ADVISORY ID:
> SA26069
>
> VERIFY ADVISORY:
> http://secunia.com/advisories/26069/
>
> CRITICAL:
> Less critical
>
> IMPACT:
> Spoofing
>
> WHERE:
> From remote
>
> SOFTWARE:
> Microsoft Internet Explorer 7.x
> http://secunia.com/product/12366/
>
> DESCRIPTION:
> Michal Zalewski has discovered a vulnerability in Internet Explorer,
> which can be exploited by a malicious website to spoof the address
> bar.
>
> The vulnerability is caused due to an error in the handling of the
> "document.open()" method and can be exploited to spoof the address
> bar if e.g. the user enters a new website manually in the address
> bar, which is commonly exercised as best practice.
>
> The vulnerability is confirmed on a fully patched Windows XP SP2
> system running Internet Explorer 7. Other versions may also be
> affected.
>
> SOLUTION:
> Close all browser windows after visiting untrusted websites.
>
> PROVIDED AND/OR DISCOVERED BY:
> Michal Zalewski
>
> ORIGINAL ADVISORY:
> http://lists.grok.org.uk/pipermail/full-disclosure/2007-July/0
> 64636.html
>