Microsoft probes IE flaw that allows spoofing of Web sites

Computerworld - Microsoft Corp. is investigating a reported flaw in its Internet Explorer software that could allow "phishers" to lure users even more convincingly to forged and potentially malicious sites.
The flaw, which appears to affect all versions of Internet Explorer and possibly other Web browsers, allows attackers to craft URLs that make it appear as if a Web page is being hosted on a domain different from its actual location, according to a description of the flaw on the popular BugTraq newslist.
The vulnerability is the result of a flaw in the way that Internet Explorer displays URLs in the address bar, according to BugTraq posters.
"The most common concern is that because the bug allows an attacker to forge the information in the address bar, attackers are going to use it to convince unsuspecting consumers to go to forged bank sites or other such sites the user trusts," said Russ Cooper, editor of NTBugTraq, a rival newslist, in an editorial posted today.
A majority of users in an online poll thought the problem was serious enough to ask Microsoft to issue an emergency patch to fix the flaw, Cooper said. In the NTBugtraq poll, more than 60% of the 380 or so users who responded said the problem required an emergency fix from Microsoft.
A Microsoft spokesman said the company was in the process of investigating the problem. The company first heard of the flaw only after details of it had already been posted on BugTraq, giving Microsoft no time to patch or investigate it fully.
"The person who posted this decided to do so without contacting Microsoft first. That obviously puts customers and users at risk. Microsoft has not had a chance to respond to this," the spokesman said.
The spokesman added that there are no other details to share at this time and that a decision has yet to be made on whether an interim work-around is necessary.
Despite the poll results, which indicated a high level of user concern, the flaw may not be all that serious, Cooper said. The flaw will most likely be exploited in so-called phishing scams, where social engineering is used to dupe unsuspecting users into clicking on links that take them to forged Web sites that appear to belong to reputable companies. The flaw will allow attackers to craft Web addresses that appear to be even more genuine. Users who avoid such links should be safe, Cooper said.