Microsoft blunts hooks of nasty Internet Explorer phishing flaw
Hacker drops policy bypass disclosure
Microsoft is investigating an alleged vulnerability in its flagship Internet Explorer browser.
The cross-site scripting hole disclosed Saturday by hacker David Leo includes functional proof of concept code, according to confirmed reports.
Vulture South reported the flaw to Microsoft Friday and has been told it is working to develop a patch. We've not been offered a timeframe fo the fix.
The flaw reportedly works against updated instances of the browser operating on Windows 7.
We shall not link to the flaw because the demonstration page runs a heap of scripts, but if you want to see it at work point your browser to http://www.deusen.co.uk/items/insider3show.3362009741042107, where Leo explains the exploit.
Tumblr security bod Joey Fowler writing on the Full Disclosure mailing list said the vulnerability was a credible and dangerous threat.
"As long as the page(s) being framed don't contain X-Frame-Options headers (with `deny` or `same-origin` values), it executes successfully," Fowler said in a confirmed post.
Fowler said it made available all viable cross-site scripting vectors to attackers.
Leo used "news" site The Daily Mail to demonstrate the attack. Internet Explorer users clicking his crafted would be served a prompt and direct users to the mail page where an external page was loaded reading 'hacked by Deusen'.
The browser address bar would remain unchanged during the attack making it an attractive means of phishing users which could easily be used in live attacks prior to Redmond releasing a patch. ®