Secunia

Lostmon has discovered a vulnerability in Internet Explorer, which can be exploited by malicious people to spoof parts of the address bar.

The vulnerability is caused due to an error when opening a new window using "window.open()", which can be exploited to display spoofed content in the browser window while the address bar shows an arbitrary path on a possibly trusted host.

Successful exploitation requires the ability to modify page content on a host that a user may consider partly trusted (e.g. a shared hosting environment).

The vulnerability is confirmed in Internet Explorer 6, 7, and 8 on a fully-patched Windows XP SP3. Other versions may also be affected.

Solution
Do not navigate to sensitive pages via untrusted web pages.

Provided and/or discovered by
Lostmon

Changelog
Further details available in Customer Area

Original Advisory
http://lostmon.blogspot.com/2009/08/multiple-browsers-fake-url-folder-file.html

Deep Links
Links available in Customer Area