Spoofing flaw in multiple browsers

Article

Spoofing flaw in multiple browsers

Bill Brenner, News Writer

Attackers could exploit an unpatched security hole in multiple browsers to spoof the URL in your address bar and play similar tricks with SSL certificates and status bars, according to Secunia.

The Danish security firm labeled the vulnerability "moderately critical" and is offering a test users can run to see if their browsers are affected. The firm recommends users manually type URLs in the address bar and avoid links from untrusted sources.

The security hole is the "unintended result of the International Domain Name (IDN) implementation," which allows the use of international characters in domain names. "This can be exploited by registering domain names with certain international characters that resemble other commonly used characters, thereby causing the user to believe they are on a trusted site," Secunia said in its advisory.

The vulnerability has been confirmed in the following products:

  • Opera 7.54u1 and 7.54u2
  • Netscape 7.2
  • Mozilla 1.7.5 and Firefox 1.0
  • OmniWeb 5.1
  • Safari 1.2.4
  • Konqueror 3.2.2.

    Requires Free Membership to View

    SearchSecurity.com members gain immediate and unlimited access to breaking industry news, virus alerts, new hacker threats, highly focused security newsletters, and more -- all at no cost. Join me on SearchSecurity.com today!

    Michael S. Mimoso, Editorial Director

    By submitting your registration information to SearchSecurity.com you agree to receive email communications from TechTarget and TechTarget partners. We encourage you to read our Privacy Policy which contains important disclosures about how we collect and use your registration and other information. If you reside outside of the United States, by submitting this registration information you consent to having your personal data transferred to and processed in the United States. Your use of SearchSecurity.com is governed by our Terms of Use. You may contact us at webmaster@TechTarget.com.

Related news stories

Attacking the alternative: A look at Mozilla's Firefox browser

Injection flaw in popular browsers


Join the conversationComment

Share
Comments

    Results

    Contribute to the conversation

    All fields are required. Comments will appear at the bottom of the article.