[MW Forums]

A dangerous spoofing security hole has been found in almost every browser on the market -- except one. Mozilla, Firefox, Safari, OmniWeb, Opera and Netscape all suffer from the "moderately critical" vulnerability that allows the spoofing of address bar URLs and SSL certificates, but, incredibly Microsoft Corp.'s Internet Explorer gets a clean bill of health. more

[macnut222]

For Safari users, check this out. It's not a fix, but it will tell you when the link you clicked on is spoofed.
http://haoli.dnsalia.../Saft/Download/ (Look for "Saft Lite")

[Escamillo]

"the flaw affect the range of browsers using the open-source Gecko browser kernel."
Ahh, the joys of "mono-culture". /forums/ubbthreads/images/graemlins/smirk.gif

[macFanDave]

Isn't Safari based on Konqueror (KHTML)?

[Rugby]

In reply to:

---

For Safari users, check this out. It's not a fix, but it will tell you when the link you clicked on is spoofed

---

I do not dare to click on the URL, it could be a spoofed link

[someJoker]

icab is not affected...

[dbutenhof]

In reply to:

---

Isn't Safari based on Konqueror (KHTML)?

---

More or less. Apple took the open source renderer, enhanced it, and used it as the basis for WebCore, which is the core of Safari. KDE absorbed the open source changes; so given sufficiently recent Konqueror, the rendering code for it and Safari are essentially identical. This source base has no substantial direct influence from or on Gecko; so characterizing these as a single family is misleading.
I wonder if the difference is that Windows IE uses unicode while the others are ASCII based?

[meancode]

If you read the original advisory it says both KHTML based AND Gecko based browsers.

[richcon]

Actually, though the article pins the blame on Gecko, it seems to affect ALL modern browsers regardless of which engine they use, so long as they support the international domain name standard (which is intended to allow domain names to be in their native languages, and uses Unicode for the text encoding). This includes Gecko-based browsers, KHTML-based browsers, and even Opera. Microsoft's browser is excluded because they don't adhere to that standard.
The problem is that Unicode includes several identical-looking characters with different numerical codes. They look the same to humans but different to computers.
Their test case puts 'http://www.paypal.com/' in the address bar, but the second 'a' in paypal is actually an extended Unicode character that looks like a normal 'a'. Browsers that display Unicode domain names display it correctly, while IE, which doesn't support Unicode domain names, displays gibberish: 'http://www.paypl.com/'.
The security flaw seems to be in the standard itself. The only thing that saved Microsoft here is that their standards support is so out of date.

[Mac007]

I tried the link where they can test you for this vulnerability and my copy passed.

[d00d]

My copy didn't. It still said "paypal.com".

[warlock7]

As for IE, even a stopped clock is right twice a day.

[Escamillo]

Well, the IDN standard itself is flawed and is a feature that should be killed. /forums/ubbthreads/images/graemlins/grin.gif
Many of the Windows security problems in the 90's were due to it's having useful features that could be exploited for evil. Things like making it too easy to open certain types of email attachments (like executables). This was a very useful feature until it started to be exploited. With everyone screaming "security over features" in their ears, Microsoft severely crippled that feature so that now "dangerous" attachments must be sent as zip files, opened, and then run. Some attachments are just removed altogether. Yes, it's a lot safer but also much more inconvenient.
Well, this IDN feature was something that sounded good, but it's exploitable, so it too must be killed (or crippled, or made to look ugly (some of the proposals that slashdot folks are making are to use different color fonts for different character sets blech)).

[macnuke]

then again.. personally, I either enter my secured pages by typing them or by a previously created bookmark... never from a link. maybe I am paranoid.
m /forums/ubbthreads/images/graemlins/grin.gif