The "less critical" flaw, according to tracking firm Secunia, is caused by an error in the processing of the
"document.open()" method, used to open a new window and load documents as specified by a URL.
In the case of this vulnerability, users visiting a malicious website who try to navigate off the site – by manually entering a new URL – are brought to a compromised webpage hosted by the attacker even though the address bar shows them to be at the legitimate site they requested.
"Microsoft's (IE) seems to have a soft spot for browser entrapment vulnerabilities," discovering researcher Michal Zalewski said on the Full Disclosure mailing list.
"Just to recap, in these attacks, the user is made (to) believe he had left a webpage…but in reality, is prevented from doing so, and his browser continues to display content originating from the attacker."
In lieu of a patch, users are advised to close the windows of untrusted websites, according to today’s Secunia
advisory.
The flaw, which requires JavaScript to run, was not tested in IE6, said Zalewski, who posted a
demonstration of the attack.
Microsoft is investigating claims of the vulnerability and is not aware of any public exploits, a company spokesman told SCMagazine.com in an email.