Domain Registration Related News
Microsoft Issues
Critical Update On URL Spoofing
Feb 2004
Microsoft has
issued a promised patch for Internet Explorer that
addresses a URL spoofing flaw, as well as a
critical security hole that could allow crackers
to gain control of Internet-connected computers
through Javascript links in web pages.
The latest IE update disallows the use of the "@"
character in URLs, addressing a snafu which has
helped phishing scammers to disguise the Internet
address of a fake Web site. Once the update is
installed, including the @ symbol in urls will
return an "invalid syntax error" message. Internet
scammers have been using @ signs in urls to trick
bank customers into revealing their account
details.
The latest patch also fixes a cross-domain
scripting vulnerability in Internet Explorer,
through which a remote attacker could bypass
security measures that limit the commands that
Web-based code can execute on a user machine. The
flaw enables a link containing Javascript code to
run commands in the Local Machine Zone with user
privileges.
|