Signature Detail

HTTP: Microsoft Internet Explorer 7 Navigation Canceled Page Cross-Site Scripting

This signature detects attempts to exploit a known vulnerability against Internet Explorer. Versions 7.0 are vulnerable. Attackers can trick a user into visiting Web pages through Cross-Site Scripting that are often used in Phishing scams.

Extended Description

Microsoft Internet Explorer is prone to a cross-site scripting vulnerability because the application fails to sufficiently sanitize user-supplied data. An attacker can exploit this issue to spoof the contents of the Navigation canceled page, steal cookie-based authentication credentials, and obtain other sensitive information. Successful exploits may assist in phishing or other attacks that rely on content spoofing.

Affected Products

• Avaya Customer Interaction Express (CIE) User Interface 1.0
• Avaya Messaging Application Server MM 2.0
• Avaya Messaging Application Server MM 3.0
• Avaya Messaging Application Server MM 3.1
• Avaya Messaging Application Server
• HP Storage Management Appliance 2.1
• Microsoft Internet Explorer 7.0
• Nortel Networks Centrex IP Client Manager 7.0.0
• Nortel Networks Centrex IP Client Manager 8.0.0
• Nortel Networks Centrex IP Client Manager 9.0
• Nortel Networks Centrex IP Client Manager

References

• BugTraq: 22966
• CVE: CVE-2007-1499
• URL: http://lists.grok.org.uk/pipermail/full-disclosure/2007-March/052972.html
• URL: http://aviv.raffon.net/2007/03/14/PhishingUsingIE7LocalResourceVulnerability.aspx