Broadband Tech > Security > Security > New IE Vulnerability Allows Address Bar Spoofing

New IE Vulnerability Allows Address Bar Spoofing

"You are vulnerable, if a new window is opened and content from Secunia is displayed while the address bar still says "http://www.google.com/".

You are not vulnerable to this particular exploit, if you do not experience the above behaviour."

IE6 SP2, latest Flash. The address bar said »www.google.com and displayed Google content. Hmmm?

Interesting, I have same and see problems already.

Phisher's are already ALL over this exploit!
--
Black, Grey and White Hats Unite here -> »testing.OnlyTheRightAnswers.com

I'm not convinced that input boxes could load & a form submit action can happen with what I've seen from the exploit sample page.

reply to ZOverLord
I replicated my settings to a virtual machine, whose default security settings were vulnerable. It wasn't vulernable anymore. I didn't disable ActiveX... not that any ActiveX controls can install in a limited account anyway. I didn't disable Active Scripting. Going through the settings one by one, this solved it:

Disable "Navigate sub-frames across different domains"

Lol, it amazes me that is Enabled by default, Like, Sure that's a good idea.

Off if on high setting
»Microsoft Application Tips and Tweaks »Concerning Internet Options Security, what do some of the settings mean
»/r0/download/4···ions.gif

Cudni
--
Some are born to failure, others achieve it, all deserve it
Help yourself so God can help you

reply to ZOverLord
With IE settings locked down (Security and Privacy set to High) nothing happens and the address remains: ht*tp://secunia.com/Internet_Explorer_Address_Bar_Spoofing_Vulnerability_Test/

IE6 - XP SP2
--
"Be simple, be earnest and spread that simplicity throughout everything you do."

Confirm.

IE6 - Win2K

reply to Sparrow

reply to ZOverLord

function openWin(url)
{
  window.open(url, 'window');
}

function StartTest()
{
  openWin('»www.google.com/');

  setTimeout("openWin('/19521_swf/?" + Math.random() + "');", 300);

  setTimeout("openWin('/19521_swf_result/');", 2500);
}

I'ts very clear that the 'exploit' does not use any input/submit actions. To put it another way, do you believe a phish could load a fake page with a CC# input box, have that box filled out & then submitted elsewhere all the while the page is loading?

reply to ZOverLord

reply to Snowy

Getting someone to land on the fake page is the phish challenge so if you mean that a phish run this exploit from it's fake page then the phish doesn't really need to utilize this exploit. I just can't seem see how it's helping a phish.

reply to ZOverLord

Interesting, and you never see Google even flash in the browser window itself?