Microsoft is investigating two recently disclosed security vulnerabilities that affect Internet Explorer 7 and Windows Vista, the company said on Monday.
The vulnerabilities aren't considered high-risk, yet they affect the latest releases of Microsoft's web browser and operating system software. Microsoft has promoted the security of both IE7 and Windows Vista. The flaws could let attackers get their hands on sensitive user information, security experts have warned.
The French Security Incident Response Team (FrSIRT) said in an alert that the IE vulnerability, which also affects IE6, could be exploited in phishing attacks, scams that try to trick people into giving up sensitive information such as credit card data and Social Security numbers. The problem exists because of an error in the way the browser handles certain "onunload" events, the security monitoring company said. Attackers could exploit the issue to spoof the browser address bar, FrSIRT said.
The Windows issue is due to a problem with a component that does not properly validate user permissions. This could be exploited by an attacker with access to the machine to get information on protected files, according to a second FrSIRT alert. The problem affects Windows Vista, XP, 2000 and Windows Server 2003, FrSIRT said.
Microsoft is looking into both vulnerabilities, which were made public last week. Neither of the flaws has been used in any attacks and exploiting the issues is hard, a company representative said.
The IE flaw could only be exploited if an attacker were to lure a victim to a malicious website and then persuade the user to enter the address of a trusted site into the address bar. "Customers can avoid this attack by opening and using a new instance of IE before visiting an untrusted site," Microsoft said.
The Windows problem, aside from requiring the attacker to be logged on to the vulnerable computer, appears to only expose file information, not the actual contents of the file, Microsoft said.
Upon completion of its investigations, Microsoft may issue a security advisory or provide security updates through its monthly patch process, the representative said.
Talkback
We needed a Gateway laptop with Vista Business, but at Best Buy could only purchase with Vista Home preinstalled along with an "upgrade disc which will enable online upgrade".
We were not given the option of upgrading to a business edition only the ultimate version, unnecessary and OTT, but to add insult to injury having deducted the fee from the credit card and completed the "upgrade", along comes the supposedly defunct Blue Screen of Death necessitating a complete reinstall (back to Vista Home).
A look at the paid for options available did not reveal the upgrade so the process had to be repeated with exactly the same result. And now we have 2 debits to the CC, a useless laptop and no one accepting liability.
Nice one MS
Don't feel like the Lone Ranger yellowcave, there are a lot of people in your situation. Don't expect a lot from M$ either, they have what they want, your money. Plus, thanks to their EULA, they bear no responsibility to the user, so it becomes a user problem. Typical Redmond attitude.