CVE-2007-3164: Medium severity Microsoft Internet Explorer vulnerability

Published Jun 11, 2007

Updated

Microsoft Internet Explorer 7, when prompting for HTTP Basic Authentication for an IDN web site, uses ACE labels for the domain name in the status bar, but uses internationalized labels for this name in the authentication dialog, which might allow remote attackers to perform phishing attacks if the user misinterprets confusable characters in the internationalized labels, as demonstrated by displaying xn--theshmogroup-bgk.com only in the status bar.

Affected Software

1 affected component

Microsoft Internet Explorer=7.0

Event History

Jun 11, 2007

CVE Published

via MITRE·10:00 PM

Data Sourced

via MITRE·10:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2007-3164?

CVE-2007-3164 is considered a moderate severity vulnerability.

How does CVE-2007-3164 allow for phishing attacks?

CVE-2007-3164 allows remote attackers to execute phishing attacks by displaying different representations of domain names in the status bar and authentication dialog.

Which version of Internet Explorer is affected by CVE-2007-3164?

CVE-2007-3164 specifically affects Microsoft Internet Explorer version 7.0.

What mitigations are recommended for CVE-2007-3164?

Users are advised to avoid using Internet Explorer 7.0 and consider upgrading to a more secure browser version.

Is CVE-2007-3164 related to HTTP Basic Authentication?

Yes, CVE-2007-3164 is directly related to how Internet Explorer 7 handles HTTP Basic Authentication with internationalized domain names.