Feeds

MS and researchers split hairs over first IE7 flaw

Bun fight over bug report

High performance access to file storage

A dispute has broken out over reports of the first security vulnerability in IE7 since its release earlier this week.

Microsoft claims the vulnerability stems from a flaw in Outlook Express, but security researchers say that since the bug can be exploited via IE7 it is really an IE7 vulnerability.

The dispute kicked off on Thursday after security notification firm Secunia published an alert about an information disclosure bug affecting IE7 hours after the release of Microsoft's long-awaited browser.

The flaw is said to stem from errors in the handling of redirections for URLs with the "mhtml:" URI handler. Secunia reports that the same bug was discovered six months ago in IE6 but remains unresolved. The flaw might be used to access documents served from another website, a trick that could be useful in various scam and phishing attacks.

Microsoft branded reports of the first IE7 bug as "technically inaccurate". It said the security bug Secunia refers to, which Redmond has under investigation, involves Outlook Express and not Internet Explorer.

"The issue concerned in these reports is not in Internet Explorer 7 (or any other version) at all. Rather, it is in a different Windows component, specifically a component in Outlook Express," writes Microsoft staffer Christopher Budd on MS's official security response weblog.

Budd adds that Microsoft has received no reports of the misuse of the vulnerability in attacks against its customers.

Secunia maintains it was right to describe IE7 as vulnerable to the security bug it highlighted. It claims Microsoft is being disingenuous in claiming otherwise.

"The vulnerability is fully exploitable via IE, which is the primary attack vector, if not the only attack vector," Secunia CTO of security notification Thomas Kristensen said.

"For a long time Microsoft has had a policy of tagging various vulnerabilities where IE was the primary or only attack vector as operating system vulnerabilities. While it may be correct from an organisational (and PR?) point of view within Microsoft, this does not fit into how it is perceived by users and administrators and how they are going to defend against exploitation.

"Hiding behind an explanation that certain vulnerabilities, which only are exploitable through Internet Explorer, are to blame on Outlook Express, Microsoft Windows, or other core Microsoft Windows components seems more like a way to promote security of IE rather than standing up and explaining to the users where the true risk is and taking responsibility for the vulnerabilities and risks in IE, which are caused by IE being so heavily integrated with the underlying operating system and other Microsoft components," Kristensen concludes.

The SANS Institute's Internet Storm Centre provided a neutral perspective. Its analysis confirms that the vulnerability exists in the MSXML ActiveX component which is actually part of Outlook Express, but it agrees with Secunia's assessment that the bug in exploitable via Internet Explorer and that both IE6 and IE7 are vulnerable. ®

High performance access to file storage

More from The Register

next story
Obama allows NSA to exploit 0-days: report
If the spooks say they need it, they get it
Parent gabfest Mumsnet hit by SSL bug: My heart bleeds, grins hacker
Natter-board tells middle-class Britain to purée its passwords
Web data BLEEDOUT: Users to feel the pain as Heartbleed bug revealed
Vendors and ISPs have work to do updating firmware - if it's possible to fix this
OpenSSL Heartbleed: Bloody nose for open-source bleeding hearts
Bloke behind the cockup says not enough people are helping crucial crypto project
One year on: diplomatic fail as Chinese APT gangs get back to work
Mandiant says past 12 months shows Beijing won't call off its hackers
Call of Duty 'fragged using OpenSSL's Heartbleed exploit'
So it begins ... or maybe not, says one analyst
German space centre endures cyber attack
Chinese code retrieved but NSA hack not ruled out
Experian subsidiary faces MEGA-PROBE for 'selling consumer data to fraudster'
US attorneys general roll up sleeves, snap on gloves
prev story

Whitepapers

Securing web applications made simple and scalable
In this whitepaper learn how automated security testing can provide a simple and scalable way to protect your web applications.
Five 3D headsets to be won!
We were so impressed by the Durovis Dive headset we’ve asked the company to give some away to Reg readers.
HP ArcSight ESM solution helps Finansbank
Based on their experience using HP ArcSight Enterprise Security Manager for IT security operations, Finansbank moved to HP ArcSight ESM for fraud management.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Mobile application security study
Download this report to see the alarming realities regarding the sheer number of applications vulnerable to attack, as well as the most common and easily addressable vulnerability errors.