Another MS Internet Explorer vulnerability found

[symphonix]

See the demonstration here:

http://www.zapthedingbat.com/security/ex01/vun1.htm

Essentially, this uses a non printing character before the @ symbol in an address of the format http://user@address.net

So, when you're going to http://www.microsoft.com(non-printing char)@www.myfakesite.com it will appear in the address bar as www.microsoft.com. In this way, it is possible for malicious geeks to put up a fake site and convince users it is genuine. Not sure if this applies to MSIE for Mac, though.

More info:

http://news.com.com/2100-7355_3-5119440.html?tag=nefd_top

http://www.eweek.com/article2/0,4149,1409700,00.asp

http://www.theregister.co.uk/content/55/34447.html

 

[bobw]

This news is a little old. Scammers have been doing this for awhile. MS should have had the patch for this released already.

 

[mdnky]

Good old fashioned M$, I'd say another 5 years before the patch come out. (Being generous, I know)

 

[Giaguara]

Yea, in Longhorn Serive pack III for Business. Somewhere like February 2007