Microsoft is investigating a reported flaw in its Internet Explorer software that could allow phishers to lure users even more convincingly to forged and potentially malicious sites.
The flaw, which appears to affect all versions of Internet Explorer and possibly other web browsers, allows attackers to craft URLs that make it appear as if a web page is being hosted on a domain different from its actual location, according BugTraq.
The vulnerability is the result of a flaw in the way that Internet Explorer displays URLs in the address bar.
"The most common concern is that because the bug allows an attacker to forge the information in the address bar, attackers are going to use it to convince unsuspecting consumers to go to forged bank sites or other such sites the user trusts," said Russ Cooper, editor of NTBugTraq.
In aon online poll hosted by NTBugtraq, more than 60% of the 380 or so users who responded said the problem required an emergency fix from Microsoft.
A Microsoft spokesman said the company was in the process of investigating the problem. The company first heard of the flaw only after details of it had already been posted on BugTraq.
"The person who posted this decided to do so without contacting Microsoft first. That obviously puts customers and users at risk. Microsoft has not had a chance to respond to this," the spokesman said.
The spokesman added that there are no other details to share at this time and that a decision has yet to be made on whether an interim work-around is necessary.
Despite the poll results, which indicated a high level of user concern, the flaw may not be all that serious, Cooper admitted. The flaw will most likely be exploited in so-called phishing scams, where social engineering is used to dupe unsuspecting users into clicking on links that take them to forged websites that appear to belong to reputable companies.
Users who avoid such links should be safe, Cooper said.
Jaikumar Vijayan writes for Computerworld