Exploit code released for unpatched IE 7 vulnerability
July 1, 2008 – 6:22 AMAnother day, another gaping hole affecting fully patched versions of Microsoft’s Internet Explorer browser.
According to a warning from US-CERT, proof-of-concept exploit code has been published for a new zero-day bug that can be used for a variety of malicious attacks against Windows users running IE 6, IE 7, and IE 8 beta 1.
The code, published here by ’sirdarckat’, shows how the vulnerability can be exploited to hijack an iFrame in a legitimate site and capture a target’s keystrokes. This occurs because Internet Explorer fails to properly restrict access to a document’s frames, allowing an attacker to modify the contents of frames in a different domain.
You must be logged in to post a comment.