[ISN] Microsoft probes IE 7, Vista bug reports

From: InfoSec News (alerts@private)
Date: Tue Feb 27 2007 - 00:22:19 PST


By Joris Evers
Staff Writer, CNET News.com
February 26, 2007

Microsoft is investigating two recently disclosed security 
vulnerabilities that affect Internet Explorer 7 and Windows Vista, the 
company said Monday.

The vulnerabilities aren't considered high-risk, yet they affect the 
latest releases of Microsoft's Web browser and operating system 
software. Microsoft has promoted the security of both IE 7 and Windows 
Vista. The flaws could let attackers get their hands on sensitive user 
information, security experts have warned.

The French Security Incident Response Team said in an alert that the IE 
vulnerability, which also affects IE 6, could be exploited in phishing 
attacks, scams that try to trick people into giving up sensitive 
information such as credit card data and Social Security numbers. The 
problem exists because of an error in the way the browser handles 
certain "onunload" events, the security monitoring company said. 
Attackers could exploit the issue to spoof the browser address bar, 
FrSirt said.

The Windows issue is due to a problem with a component that does not 
properly validate user permissions. This could be exploited by an 
attacker with access to the machine to get information on protected 
files, according to a second FrSirt alert. The problem affects Windows 
Vista, XP, 2000 and Windows Server 2003, FrSirt said.

Microsoft is looking into both vulnerabilities, which were made public 
last week. Neither of the flaws has been used in any attacks and 
exploiting the issues is hard, a company representative said.

The IE flaw could only be exploited if an attacker were to lure a victim 
to a malicious Web site and then persuade the user to enter the address 
of a trusted site into the address bar. "Customers can avoid this attack 
by opening and using a new instance of IE before visiting an untrusted 
site," Microsoft said.

The Windows problem, aside from requiring the attacker to be logged on 
to the vulnerable computer, appears to only expose file information, not 
the actual contents of the file, Microsoft said.

Upon completion of its investigations, Microsoft may issue a security 
advisory or provide security updates through its monthly patch process, 
the representative said.

Subscribe to the InfoSec News RSS Feed

This archive was generated by hypermail 2.1.3 : Tue Feb 27 2007 - 00:34:00 PST