PT-2007-2519 · Microsoft · Internet Explorer

Jakob Balle · Published 2007-02-26 · Updated 2021-07-23 · CVE-2007-1091

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Microsoft Internet Explorer version 7

Description The issue allows remote attackers to prevent users from leaving a site, spoof the address bar, and conduct phishing and other attacks. Spoofing vulnerabilities exist that could allow an attacker to display spoofed content in a browser window, where the address bar and other parts of the trust UI have been navigated away from the attacker's Web site but the content of the window still contains the attacker's Web page.

Recommendations For Microsoft Internet Explorer version 7, consider disabling the use of onUnload Javascript handlers as a temporary workaround to minimize the risk of exploitation. Restrict access to potentially malicious Web sites to prevent spoofing attacks.

Fix

Related Identifiers

CVE-2007-1091

Affected Products

Internet Explorer

References · 20

• http://securityfocus.com/archive/1/482366/100/0/threaded · Vendor Advisory
• http://secunia.com/advisories/23014 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2007-1091 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1091 · Security Note
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2007/ms07-057 · Vendor Advisory
• http://vupen.com/english/advisories/2007/0713 · Note
• http://xforce.iss.net/xforce/xfdb/32647 · Note
• http://xforce.iss.net/xforce/xfdb/32649 · Note
• https://docs.microsoft.com/security-updates/securitybulletins/2007/MS07-057 · Note
• http://lists.grok.org.uk/pipermail/full-disclosure/2007-February/052630.html · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/32649 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/32647 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A2162 · Note
• http://securityreason.com/securityalert/2291 · Note
• http://securityfocus.com/bid/22680 · Note