Since this story was originally posted, its final paragraph has been modified to correctly identify the software component that Microsoft blamed for a security flaw.A security problem originally found in Microsoft’s Internet Explorer 6 browser has returned to haunt IE7, the new version of the browser launched two weeks ago, a security consultant said Monday.Danish security consultancy Secunia posted an advisory regarding an issue whereby an attacker could potentially snare log-ins and passwords from an unsuspecting IE7 user. More than two years ago, security researchers reported the same fault in IE6. If a user visits a website specially crafted by an attacker, and then opens a “trusted” site such as a bank or e-commerce site that has a pop-up window, the attacker can put new content into the pop-up, said Thomas Kristensen, Secunia’s chief technology officer. This could enable the attacker to ask a user for financial information or passwords, he said. When the problem was revealed in June 2004, Microsoft gave instructions for a workaround for IE6: disable the setting “Navigate sub-frames across different domains.” That setting is disabled by default in IE7, but does not appear to prevent the attack, Kristensen said.Microsoft has been notified of the flaw, which was submitted to Secunia by a user, Kristensen said. Microsoft officials did not have an immediate comment on Monday morning. Secunia rated the problem as “moderately critical,” but Kristensen said the company was not aware of sites trying to exploit the flaw. Alert users might notice that they’re under attack. Since the URL for the pop-up window is visible, it may be possible to identify a fraudulent request for password information, for example. But “it would require you to pay some attention to the address bar,” Kristensen said.However, a clever attacker could also use this problem in combination with a pop-up spoofing weakness identified last week. Microsoft hasn’t patched that problem.Following IE7’s release on Oct. 18, Secunia found a problem it shared with IE6. The vulnerability allowed an attacker to potentially read information from a secure website if the user had also opened a maliciously crafted website. Microsoft said the problem is actually in code called by the browsers in another application, Outlook Express, which remains unpatched.-Jeremy Kirk, IDG News Service (London Bureau)Related Links: Second IE7 Flaw Discovered, Secunia Says 1st Microsoft IE7 Security Flaw Reported Microsoft Internet Explorer 7 Browser Released Mozilla Downplays 1st Firefox 2.0 Bug ReportsThis article is posted on our Microsoft Informer page. For more news on the Redmond, Wash.-based powerhouse, keep checking in.Check out our CIO News Alerts and Tech Informer pages for more updated news coverage. Related content brandpost Sponsored by SAP Generative AI’s ‘show me the money’ moment We’re past the hype and slick gen AI sales pitches. Business leaders want results. By Julia White Nov 30, 2023 5 mins Artificial Intelligence brandpost Sponsored by Zscaler How customers capture real economic value with zero trust Unleashing economic value: Zscaler's Zero Trust Exchange transforms security architecture while cutting costs. By Zscaler Nov 30, 2023 4 mins Security brandpost Sponsored by SAP A cloud-based solution to rescue millions from energy poverty Aware of the correlation between energy and financial poverty, Savannah Energy is helping to generate clean, competitively priced electricity across Africa by integrating its old systems into one cloud-based platform. By Keith E. Greenberg, SAP Contributor Nov 30, 2023 5 mins Digital Transformation feature 8 change management questions every IT leader must answer Designed to speed adoption and achieve business outcomes, change management hasn’t historically been a strength of IT orgs. It’s time to flip that script by asking hard questions to hone change strategies. By Stephanie Overby Nov 30, 2023 10 mins Change Management Change Management IT Operations Podcasts Videos Resources Events SUBSCRIBE TO OUR NEWSLETTER From our editors straight to your inbox Get started by entering your email address below. Please enter a valid email address Subscribe