October 30, 2006 8:09 AM PST
Another IE 7 pop-up problem discovered
Last modified: October 30, 2006 2:53 PM PST
- Related Stories
-
Spoofing bug found in IE 7
October 25, 2006 -
Minor issues surface after IE 7 launch
October 19, 2006 -
Microsoft tags IE 7 'high priority' update
July 26, 2006
The browser issue could affect users who visit a trusted site by opening a pop-up window in that site that contains malicious code. This is the second IE 7 problem that has been discovered since Microsoft released the browser two weeks ago. Last week, a security flaw was discovered in IE 7 that could spoof the address of a pop-up window.
The two IE 7 security holes, if used in conjunction with each other, can easily dupe all but the most security-minded users, said Thomas Kristensen, chief technology officer of security company Secunia, which discovered the problems.
Secunia has classed the latest problem a security vulnerability, while Microsoft states the situation arises from "by-design behavior" in the browsers.
"The (Secunia) report describes a by-design behavior in popular Web browsers that allows a Web site to open or re-use a pop-up window," a Microsoft reprensentative said. "In Internet Explorer 7, the Web page's actual URL is displayed in a pop-up window address bar, enabling users to accurately make a trust decision."
Microsoft said that people who follow its safe browsing guidelines and verify an HTTPS connection before entering sensitive personal information can increase their ability to guard against an exploit.
Secunia rated the most recent flaw as "moderately critical" because viewing the content does not provide attackers access to a user's computer. But it can still prove harmful if a user enters sensitive information into the malicious pop-up window, such as credit card information, usernames or passwords, Kristensen noted.
The vulnerability is also rated moderately critical because it requires user interaction and affects only particular trusted Web sites.
Secunia noted that the security flaw can affect a fully patched system running IE 7 and Microsoft Windows XP Service Pack 2.
The security company advises users to avoid browsing untrusted sites while browsing sites that they trust.
See more CNET content tagged:
Microsoft Internet Explorer 7,
Microsoft Internet Explorer,
attacker,
security company,
security
Dell 15" Laptop Deals
You have to navigate to a maliciuous site, which will have to open another window of a legal site, which will have to open a popup window requesting information from you.
Hm... I thought that IE7 has a popup blocker, which will prevent you from even seeing the controlled popup. At least for me it does.
And, even if you have the popup blocker off, how stupid you have to be to navigate say a porn or warez site, click on a link and see opening all of a sudden a window of your bank site which opens yet another window asking you for personal data, and you'd still be willing to provide the data?!
Alin
http://www.betanews.com/article/Vulnerability_Affects_Firefox_and_IE_New_and_Old/1162235840
People lose their life's savings on a daily basis to thieves that prey on those who don't use their common sense, even without Microsoft's or Apples help. This so-called flaw could be avoided by not putting your personal information into a pop-up. Sounds pretty easy huh?
It is very easy to point fingers when a little bit of common sense is all we need.
NetScape v7.l, v7.2 and v8.0 are not vulnerabile.
Firefox v1.5 and v2.0 are not vulnerable.
But even if you don't use Outlook... IE7 is vulnerable. Except that Microsoft still gaffs it off as an Outlook bug even though it's been PROVEN to be exploitable!!!
Walt
- Regarding popup blockers using internet explorer version 7.0
-
by nhanumath
November 9, 2006 10:17 PM PST
- Regarding popup blockers. Presently for old application we are using internet explorer version6.0. popup blockers need to be
-
Reply to this comment
-
-
See all 33 Comments >>turned off when using Internet Exploere version6.0. there is problem when user used by internet explorer7.0. For new
application will need to be entered into the Trusted Sites section because of having two or more pop-ups (when creating
reports), which IE7 is not allowing (it allows only one pop-up).