Security threats Toolkit

Microsoft update ignores spoofing hole

Munir Kotadia ZDNet.co.uk

Published: 14 Jan 2004 17:10 GMT

Microsoft released three patches on Tuesday to fix a number of security flaws, but surprised users by not releasing a patch for an Internet Explorer vulnerability that helps criminals steal users' identities and commit banking fraud.

The Internet Explorer vulnerability, which was first discovered in early December, allows the browser window to display an URL in the address tab while actually connecting to a different Web site altogether. On Monday, separate emails targeting Barclays and Lloyds TSB's online-banking customers attempted to exploit the flaw and steal customers' passwords.

However, Microsoft is not yet convinced that there is a serious problem and has so far refused to say when a fix will be released. A Microsoft spokesperson told ZDNet UK that the company is "aggressively investigating" the problem and will take "the appropriate action" on completion of its investigation. The company did admit that "it may be possible for an attacker to display misleading information" but denied the flaw was being actively exploited: "Microsoft is monitoring the situation closely but at this time has no indication of widespread usage of the vulnerability," the spokesperson said.

Microsoft also blames Web sites that publish details about the flaw without giving it enough time to fix the problem: "It is unfortunate for customers that this issue was not reported to Microsoft, following responsible disclosure practices," the spokesperson said.

In December, Openwares.org, an open-source software development Web site, posted a patch designed to fix the Internet Explorer vulnerability, but Microsoft and industry analysts advised against installing it in case it clashed with future updates.

The administrator of Openwares.org, who requested anonymity, said that the patch has been downloaded more than 125,000 times and he has received numerous emails from people thanking him, including a group of Earthlink users: "There was a phishing scam targeted at Earthlink subscribers and I have had about 20 emails from Earthlink users who almost got ripped-off; our patch helped them," he said.

Microsoft said that when it completes its investigation, the fix will be included in the next batch of patches. However, if Microsoft believes the problem requires urgent attention, a patch will be issued outside its monthly cycle.