MS and researchers split hairs over first IE7 flaw
Bun fight over bug report
A dispute has broken out over reports of the first security vulnerability in IE7 since its release earlier this week.
Microsoft claims the vulnerability stems from a flaw in Outlook Express, but security researchers say that since the bug can be exploited via IE7 it is really an IE7 vulnerability.
The dispute kicked off on Thursday after security notification firm Secunia published an alert about an information disclosure bug affecting IE7 hours after the release of Microsoft's long-awaited browser.
The flaw is said to stem from errors in the handling of redirections for URLs with the "mhtml:" URI handler. Secunia reports that the same bug was discovered six months ago in IE6 but remains unresolved. The flaw might be used to access documents served from another website, a trick that could be useful in various scam and phishing attacks.
Microsoft branded reports of the first IE7 bug as "technically inaccurate". It said the security bug Secunia refers to, which Redmond has under investigation, involves Outlook Express and not Internet Explorer.
"The issue concerned in these reports is not in Internet Explorer 7 (or any other version) at all. Rather, it is in a different Windows component, specifically a component in Outlook Express," writes Microsoft staffer Christopher Budd on MS's official security response weblog.
Budd adds that Microsoft has received no reports of the misuse of the vulnerability in attacks against its customers.
Secunia maintains it was right to describe IE7 as vulnerable to the security bug it highlighted. It claims Microsoft is being disingenuous in claiming otherwise.
"The vulnerability is fully exploitable via IE, which is the primary attack vector, if not the only attack vector," Secunia CTO of security notification Thomas Kristensen said.
"For a long time Microsoft has had a policy of tagging various vulnerabilities where IE was the primary or only attack vector as operating system vulnerabilities. While it may be correct from an organisational (and PR?) point of view within Microsoft, this does not fit into how it is perceived by users and administrators and how they are going to defend against exploitation.
"Hiding behind an explanation that certain vulnerabilities, which only are exploitable through Internet Explorer, are to blame on Outlook Express, Microsoft Windows, or other core Microsoft Windows components seems more like a way to promote security of IE rather than standing up and explaining to the users where the true risk is and taking responsibility for the vulnerabilities and risks in IE, which are caused by IE being so heavily integrated with the underlying operating system and other Microsoft components," Kristensen concludes.
The SANS Institute's Internet Storm Centre provided a neutral perspective. Its analysis confirms that the vulnerability exists in the MSXML ActiveX component which is actually part of Outlook Express, but it agrees with Secunia's assessment that the bug in exploitable via Internet Explorer and that both IE6 and IE7 are vulnerable. ®