Home > slashdot > Nasty Data-Stealing Bug Haunts Internet Explorer 8

Nasty Data-Stealing Bug Haunts Internet Explorer 8

September 4th, 2010 09:56 admin Leave a comment Go to comments

Trailrunner7 writes “There’s an unpatched vulnerability in Internet Explorer 8 that enables simple data-stealing attacks by Web-based attackers and could lead to an attacker hijacking a user’s authenticated session on a third-party site. The flaw, which a researcher said may have been known since 2008, lies in the way IE8 handles CSS. The vulnerability can be exploited through an attack scenario known as cross-domain theft, and researcher Chris Evans originally brought the problem to light in a blog post in December. At the time, all of the major browsers were vulnerable to the attack, but since then, Firefox, Chrome, Safari and Opera all have implemented a simple defense mechanism. The upshot of this is that if a victim has visited a given Web site, authenticated himself to the site, and then visits a site controlled by an attacker, the attacker would have the ability to hijack the user’s session and extract supposedly confidential data. This attack works on the latest, fully patched release of IE8.”

Source: Nasty Data-Stealing Bug Haunts Internet Explorer 8

Related Articles:

  1. No Patch On Tuesday For Internet Explorer Hole
  2. US and UK Governments Advise Avoiding Internet Explorer Until Bug Fixed
  3. Microsoft Issues Advisory For Internet Explorer Vulnerability
  4. New Attack Fells Internet Explorer
  5. Internet Explorer 0-day Attacks On US Nuke Workers Hit 9 Other Sites
blog comments powered by Disqus