IE hole allows site spoofing

By Matt Whipp

Posted on 11 Dec 2003 at 13:13

Danish security experts have identified a flaw in the Internet Explorer browser that allows a malicious website to display a trustworthy URL in the address field.

Security firm Secunia rates the hole as moderately critical and has been tested and found in version 6 of the browser, but has not been tested for earlier versions.

The hole can be exploited by inserting syntax characters after the URL you wish to be displayed, but before the actual domain name.

Microsoft has said it is looking into the problem but knows of no known exploits being used or of any affected users. Earlier this week Microsoft announced in its monthly security update there would be no security bulletins to release this month.

More information can be found at the Secunia website.