Phishing using IE7 local resource vulnerability

Summary
Internet Explorer 7.0 is vulnerable to cross-site scripting in one of its local resources. In combination with a design flaw in this specific local resource it is possible for an attacker to easily conduct phishing attacks against IE7 users.


Affected versions
• Windows Vista – Internet Explorer 7.0
• Windows XP – Internet Explorer 7.0


Proof-of-Concept is available


Workaround / Suggestion
Until Microsoft fixes this vulnerability, do not trust the “Navigation Canceled” page.


http://aviv.raffon.net/2007/03/14/PhishingUsingIE7LocalResourceVulnerability.aspx

Leave a Reply