CVE-2007-3164
First published: Mon Jun 11 2007(Updated: )
Microsoft Internet Explorer 7, when prompting for HTTP Basic Authentication for an IDN web site, uses ACE labels for the domain name in the status bar, but uses internationalized labels for this name in the authentication dialog, which might allow remote attackers to perform phishing attacks if the user misinterprets confusable characters in the internationalized labels, as demonstrated by displaying xn--theshmogroup-bgk.com only in the status bar.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Internet Explorer | =7.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://ha.ckers.org/blog/20070608/cross-domain-basic-auth-phishing-tactics/
- http://www.bitsploit.de/archives/428-Cross-Domain-Basic-Auth-Phishing-Tactics.html
- http://www.securityfocus.com/bid/24483
- http://secunia.com/advisories/25663
- http://osvdb.org/36142
- https://exchange.xforce.ibmcloud.com/vulnerabilities/34867
Frequently Asked Questions
What is the severity of CVE-2007-3164?
CVE-2007-3164 is considered a moderate severity vulnerability.
How does CVE-2007-3164 allow for phishing attacks?
CVE-2007-3164 allows remote attackers to execute phishing attacks by displaying different representations of domain names in the status bar and authentication dialog.
Which version of Internet Explorer is affected by CVE-2007-3164?
CVE-2007-3164 specifically affects Microsoft Internet Explorer version 7.0.
What mitigations are recommended for CVE-2007-3164?
Users are advised to avoid using Internet Explorer 7.0 and consider upgrading to a more secure browser version.
Is CVE-2007-3164 related to HTTP Basic Authentication?
Yes, CVE-2007-3164 is directly related to how Internet Explorer 7 handles HTTP Basic Authentication with internationalized domain names.
- agent/references
- agent/weakness
- agent/severity
- agent/first-publish-date
- agent/author
- agent/last-modified-date
- agent/softwarecombine
- agent/type
- agent/description
- agent/event
- agent/tags
- collector/nvd-historical
- agent/software-canonical-lookup-request
- collector/nvd-index
- vendor/microsoft
- canonical/internet explorer
- version/internet explorer/7.0