Microsoft Internet Explorer 7 HTTP Authentication International Domain Name Spoofing Weakness
TITLE: Microsoft Internet Explorer 7 HTTP Authentication International Domain Name Spoofing Weakness
CLASS: Design Error
CVE: CVE-2007-3164
REMOTE: Yes
LOCAL: No
PUBLISHED: Jun 05 2007 12:00AM
UPDATE: Jun 05 2007 12:00AM
CREDIT: Alexander Brachmann discovered this issue.
VULNERABLE:
Microsoft Internet Explorer 7.0NOT VULNERABLE:
Vai alla pagina originale su Security Focus
Discussion
Microsoft Internet Explorer 7 is prone to a HTTP authentication hostname spoofing weakness.
Attackers may exploit this vulnerability via a malicious webpage to spoof the origin of an HTTP authentication dialog that the victim may trust. Attackers may find this issue useful in phishing or other attacks that rely on content spoofing.
Exploit
To exploit this issue, an attacker must entice an unsuspecting user to visit a maliciously crafted webpage.
A proof-of-concept webpage has been created to demonstrate this issue. Please see the references for details.
Solution
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: mailto:vuldb@securityfocus.com.
References
References:
- Cross Domain Basic Auth Phishing Tactics (ha.ckers)
- Internet Explorer Home Page (Microsoft)
- HTTP-Auth Phishing mit Opera (Alexander Brachmann)