Microsoft spars with security analysts over IE 7 bug
TechWeb | at | by Mike
Microsoft is reacting to a report that the just-released Internet Explorer 7 contains a bug by saying the flaw is actually in Outlook Express, the free e-mail program included with Windows 2000 and XP. The security company that issued the original alert, however, said that didn't matter: attackers could use IE 7 to grab users' data.
Thursday, Danish vulnerability tracker Secunia warned that IE 7, which Microsoft unveiled in final form the night before, included a cross-domain information-disclosure vulnerability. The bug, said Secunia, was in the MHTML: URI handler, and could be used in a malicious site to hijack data entered on a separate site at which the user was already surfing. The vulnerability, said experts, might be used by identity thieves to rip off bank and credit card account usernames and passwords.