Microsoft says it is investigating reports of a security issue in Internet Explorer. The problem lies with a CSS cross-origin theft issue that has been fixed in other browsers but remains open in IE, says a Google security engineer.
Microsoft has confirmed it is investigating reports of a flaw in Internet
Explorer 8 that could be exploited to attack users.
A description of the vulnerability was posted Sept. 3 to the Full Disclosure mailing
by Google Information Security Engineer Chris Evans. In a
proof-of-concept, Evans demonstrated how the bug-a CSS
(Cascading Style Sheets) cross-origin theft issue-could be used to
force a victim to send a Twitter message.
"This is purely an IE bug; there is no fault on behalf of Twitter and
there is no reasonable workaround," Evans wrote.
Cross-origin CSS attacks are believed to
have first been described back in 2002, according to a recently published paper.
The other major browser vendors-Apple, Google, Mozilla and Opera Software-have
fixed the problem in question in their browsers, but Microsoft has not, Evans
wrote on Full Disclosure, even though there is evidence the company has
known of the problem "since at least 2008."
He declined to comment further when asked by eWEEK. But in an August blog
post, Evans said IE
was the browser most vulnerable to the CSS flaw.
"I have PoCs which will steal your Webmail's XSRF token, with follow-on
loss of account integrity and confidentiality," he posted at the
time. "It's a nasty attack: E-mail someone a link and if they click it,
they are owned with a pure browser cross-origin bug."
When asked about the flaw, Microsoft responded that it was looking into
the reports and would take appropriate action.
"Microsoft is investigating new public claims of a possible vulnerability
in Internet Explorer," Jerry Bryant, group manager of response
communications for Microsoft Security Response Center, said in a statement
Sept. 7. "We're currently unaware of any attacks trying to use the claimed
vulnerability or of customer impact. Once we're done investigating, we will
take appropriate action to help protect customers. This may include providing a
security update through the monthly release process, an out-of-cycle update or
additional guidance to help customers protect themselves."
Earlier versions of IE may be affected as well, according to Evans.