Phishing using IE7 local resource vulnerability

Internet Explorer 7.0 is vulnerable to cross-site scripting in one of its local resources. In combination with a design flaw in this specific local resource it is possible for an attacker to easily conduct phishing attacks against IE7 users.

Affected versions
• Windows Vista – Internet Explorer 7.0
• Windows XP – Internet Explorer 7.0

Proof-of-Concept is available

Workaround / Suggestion
Until Microsoft fixes this vulnerability, do not trust the “Navigation Canceled” page.

Leave a Reply