Feeds

MS and researchers split hairs over first IE7 flaw

Bun fight over bug report

The Power of One eBook: Top reasons to choose HP BladeSystem

A dispute has broken out over reports of the first security vulnerability in IE7 since its release earlier this week.

Microsoft claims the vulnerability stems from a flaw in Outlook Express, but security researchers say that since the bug can be exploited via IE7 it is really an IE7 vulnerability.

The dispute kicked off on Thursday after security notification firm Secunia published an alert about an information disclosure bug affecting IE7 hours after the release of Microsoft's long-awaited browser.

The flaw is said to stem from errors in the handling of redirections for URLs with the "mhtml:" URI handler. Secunia reports that the same bug was discovered six months ago in IE6 but remains unresolved. The flaw might be used to access documents served from another website, a trick that could be useful in various scam and phishing attacks.

Microsoft branded reports of the first IE7 bug as "technically inaccurate". It said the security bug Secunia refers to, which Redmond has under investigation, involves Outlook Express and not Internet Explorer.

"The issue concerned in these reports is not in Internet Explorer 7 (or any other version) at all. Rather, it is in a different Windows component, specifically a component in Outlook Express," writes Microsoft staffer Christopher Budd on MS's official security response weblog.

Budd adds that Microsoft has received no reports of the misuse of the vulnerability in attacks against its customers.

Secunia maintains it was right to describe IE7 as vulnerable to the security bug it highlighted. It claims Microsoft is being disingenuous in claiming otherwise.

"The vulnerability is fully exploitable via IE, which is the primary attack vector, if not the only attack vector," Secunia CTO of security notification Thomas Kristensen said.

"For a long time Microsoft has had a policy of tagging various vulnerabilities where IE was the primary or only attack vector as operating system vulnerabilities. While it may be correct from an organisational (and PR?) point of view within Microsoft, this does not fit into how it is perceived by users and administrators and how they are going to defend against exploitation.

"Hiding behind an explanation that certain vulnerabilities, which only are exploitable through Internet Explorer, are to blame on Outlook Express, Microsoft Windows, or other core Microsoft Windows components seems more like a way to promote security of IE rather than standing up and explaining to the users where the true risk is and taking responsibility for the vulnerabilities and risks in IE, which are caused by IE being so heavily integrated with the underlying operating system and other Microsoft components," Kristensen concludes.

The SANS Institute's Internet Storm Centre provided a neutral perspective. Its analysis confirms that the vulnerability exists in the MSXML ActiveX component which is actually part of Outlook Express, but it agrees with Secunia's assessment that the bug in exploitable via Internet Explorer and that both IE6 and IE7 are vulnerable. ®

Designing a Defense for Mobile Applications

More from The Register

next story
DARPA-derived secure microkernel goes open source tomorrow
Hacker-repelling, drone-protecting code will soon be yours to tweak as you see fit
How long is too long to wait for a security fix?
Synology finally patches OpenSSL bugs in Trevor's NAS
Don't look, Snowden: Security biz chases Tails with zero-day flaws alert
Exodus vows not to sell secrets of whistleblower's favorite OS
Roll out the welcome mat to hackers and crackers
Security chap pens guide to bug bounty programs that won't fail like Yahoo!'s
HIDDEN packet sniffer spy tech in MILLIONS of iPhones, iPads – expert
Don't panic though – Apple's backdoor is not wide open to all, guru tells us
Researcher sat on critical IE bugs for THREE YEARS
VUPEN waited for Pwn2Own cash while IE's sandbox leaked
Four fake Google haxbots hit YOUR WEBSITE every day
Goog the perfect ruse to slip into SEO orfice
prev story

Whitepapers

Designing a Defense for Mobile Applications
Learn about the various considerations for defending mobile applications - from the application architecture itself to the myriad testing technologies.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Top 8 considerations to enable and simplify mobility
In this whitepaper learn how to successfully add mobile capabilities simply and cost effectively.
Seven Steps to Software Security
Seven practical steps you can begin to take today to secure your applications and prevent the damages a successful cyber-attack can cause.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.