Internet Explorer Frame Spoof Vulnerability

A vulnerability exists in Microsoft® Internet Explorer® that could allow a malicious web site operator to impersonate a window on a legitimate web site. The threat posed by this vulnerability is that the bogus window could collect information from the user and send it back to the malicious site.

Issue

This vulnerability exists because Internet Explorer's cross domain protection does not extend to navigation of frames. This makes it possible for a malicious web site to insert content into a frame within another web site's window. If done properly, the user might not be able to tell that the frame contents were not from the legitimate site, and could be tricked into providing personal data to the malicious site. Non-secure (HTTP) and secure (HTTPS) sites are equally at risk from this vulnerability.

Affected Products

• Internet Explorer 3.x, 4.0, 4.01 and 4.01 SP1 on Windows NT 4.0, Windows 95 and Windows 98

Download

Patch: http://www.microsoft.com/windows/ie/security/spoof.asp

Further Details

Source: Microsoft Corporation

Reference: Microsoft Corporation

Updated: December 23, 1998

>> Recommended Download - secure your PC from spyware, adware and malware now with Spyware Doctor <<