Feeds

MS and researchers split hairs over first IE7 flaw

Bun fight over bug report

Beginner's guide to SSL certificates

A dispute has broken out over reports of the first security vulnerability in IE7 since its release earlier this week.

Microsoft claims the vulnerability stems from a flaw in Outlook Express, but security researchers say that since the bug can be exploited via IE7 it is really an IE7 vulnerability.

The dispute kicked off on Thursday after security notification firm Secunia published an alert about an information disclosure bug affecting IE7 hours after the release of Microsoft's long-awaited browser.

The flaw is said to stem from errors in the handling of redirections for URLs with the "mhtml:" URI handler. Secunia reports that the same bug was discovered six months ago in IE6 but remains unresolved. The flaw might be used to access documents served from another website, a trick that could be useful in various scam and phishing attacks.

Microsoft branded reports of the first IE7 bug as "technically inaccurate". It said the security bug Secunia refers to, which Redmond has under investigation, involves Outlook Express and not Internet Explorer.

"The issue concerned in these reports is not in Internet Explorer 7 (or any other version) at all. Rather, it is in a different Windows component, specifically a component in Outlook Express," writes Microsoft staffer Christopher Budd on MS's official security response weblog.

Budd adds that Microsoft has received no reports of the misuse of the vulnerability in attacks against its customers.

Secunia maintains it was right to describe IE7 as vulnerable to the security bug it highlighted. It claims Microsoft is being disingenuous in claiming otherwise.

"The vulnerability is fully exploitable via IE, which is the primary attack vector, if not the only attack vector," Secunia CTO of security notification Thomas Kristensen said.

"For a long time Microsoft has had a policy of tagging various vulnerabilities where IE was the primary or only attack vector as operating system vulnerabilities. While it may be correct from an organisational (and PR?) point of view within Microsoft, this does not fit into how it is perceived by users and administrators and how they are going to defend against exploitation.

"Hiding behind an explanation that certain vulnerabilities, which only are exploitable through Internet Explorer, are to blame on Outlook Express, Microsoft Windows, or other core Microsoft Windows components seems more like a way to promote security of IE rather than standing up and explaining to the users where the true risk is and taking responsibility for the vulnerabilities and risks in IE, which are caused by IE being so heavily integrated with the underlying operating system and other Microsoft components," Kristensen concludes.

The SANS Institute's Internet Storm Centre provided a neutral perspective. Its analysis confirms that the vulnerability exists in the MSXML ActiveX component which is actually part of Outlook Express, but it agrees with Secunia's assessment that the bug in exploitable via Internet Explorer and that both IE6 and IE7 are vulnerable. ®

Choosing a cloud hosting partner with confidence

More from The Register

next story
SMASH the Bash bug! Apple and Red Hat scramble for patch batches
'Applying multiple security updates is extremely difficult'
Apple's new iPhone 6 vulnerable to last year's TouchID fingerprint hack
But unsophisticated thieves need not attempt this trick
Hackers thrash Bash Shellshock bug: World races to cover hole
Update your gear now to avoid early attacks hitting the web
Oracle SHELLSHOCKER - data titan lists unpatchables
Database kingpin lists 32 products that can't be patched (yet) as GNU fixes second vuln
Who.is does the Harlem Shake
Blame it on LOLing XSS terroristas
Researchers tell black hats: 'YOU'RE SOOO PREDICTABLE'
Want to register that domain? We're way ahead of you.
Stunned by Shellshock Bash bug? Patch all you can – or be punished
UK data watchdog rolls up its sleeves, polishes truncheon
Ello? ello? ello?: Facebook challenger in DDoS KNOCKOUT
Gets back up again after half an hour though
prev story

Whitepapers

Providing a secure and efficient Helpdesk
A single remote control platform for user support is be key to providing an efficient helpdesk. Retain full control over the way in which screen and keystroke data is transmitted.
Intelligent flash storage arrays
Tegile Intelligent Storage Arrays with IntelliFlash helps IT boost storage utilization and effciency while delivering unmatched storage savings and performance.
Beginner's guide to SSL certificates
De-mystify the technology involved and give you the information you need to make the best decision when considering your online security options.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.
Secure remote control for conventional and virtual desktops
Balancing user privacy and privileged access, in accordance with compliance frameworks and legislation. Evaluating any potential remote control choice.