Arguments begin over IE7 flaw

Microsoft has denied that there is a hole in the security of it's newly released browser IE7.

Shortly after the release of the new browser vulnerability experts Secunia issued an advisory warning of a flaw in the handling of redirections for URLs. This can be exploited to access documents served from another web site.

The Secunia researchers, who based their claim on proof of concept code posted in by a third party, say the flaw is 'Less Critical', its second least serious warning level.

But Christopher Budd, who works at the Microsoft Security Response Center, has bebunked the claims, saying that the code is secure. He claims the flaw is not in the browser itself but in the other Microsoft applications it works with.

"These reports are technically inaccurate: the issue concerned in these reports is not in Internet Explorer 7 (or any other version) at all," he wrote in the Security Center's blog.

"Rather, it is in a different Windows component, specifically a component in Outlook Express. While these reports use Internet Explorer as a vector the vulnerability itself is in Outlook Express."

This explanation however cut little ice with the experts at Secunia.

"The vulnerability is fully exploitable via IE, which is the primary attack vector, if not the only attack vector<" said Thomas Kristensen

Chief technology officer at Secunia.

"Just because a vulnerability stems from an underlying component does not relieve IE or any other piece of software from responsibility when it provides a clear direct vector to the vulnerable component."

He pointed out that Microsoft had a history of flagging flaws that could only or primarily be attacked via IE as operating system rather than browser flaws.

"Hiding behind an explanation that certain vulnerabilities, which only are exploitable through Internet Explorer, are to blame on Outlook Express, Microsoft Windows, or other core Microsoft Windows components seems more like a way to promote security of IE rather than standing up and explaining the users where the true risk is and taking responsibility for the vulnerabilities and risks in IE, which are caused by IE being so heavily integrated with the underlying operating system and other Microsoft components," he continued.

Email to a friend

Print this page