PT-2007-4447 · Microsoft · Internet Explorer

Published 2007-06-11 · Updated 2021-07-23 · CVE-2007-3164

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions: Microsoft Internet Explorer version 7

Description: The issue concerns a potential phishing attack when Microsoft Internet Explorer 7 prompts for HTTP Basic Authentication for an IDN web site. It uses ACE labels for the domain name in the status bar but internationalized labels in the authentication dialog. This discrepancy might allow remote attackers to perform phishing attacks if the user misinterprets confusable characters in the internationalized labels.

Recommendations: For Microsoft Internet Explorer version 7, consider avoiding the use of internationalized domain names in authentication dialogs until a fix is available. As a temporary workaround, users should be cautious when interpreting domain names in authentication prompts to minimize the risk of phishing attacks.

Fix

Related Identifiers

CVE-2007-3164

Affected Products

Internet Explorer

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2007-3164 · Security Note
• http://bitsploit.de/archives/428-Cross-Domain-Basic-Auth-Phishing-Tactics.html · Note
• http://secunia.com/advisories/25663 · Note
• http://securityfocus.com/bid/24483 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/34867 · Note
• http://ha.ckers.org/blog/20070608/cross-domain-basic-auth-phishing-tactics · Note
• http://osvdb.org/36142 · Note