Web browsers affected by Clickjacking
US CERT issues a warning about a new cross-browser exploit technique called “Clickjacking”; clickjacking gives an attacker the ability to trick a user into clicking on something only barely or momentarily noticeable; thus, if a user clicks on a Web page, they may actually be clicking on content from another page
A new alert from U.S. Computer Emergency Readiness Team (US-CERT). The agency says it is aware of public reports of a new cross-browser exploit technique called “Clickjacking.” According to one report, Clickjacking gives an attacker the ability to trick a user into clicking on something only barely or momentarily noticeable. Therefore, if a user clicks on a Web page, they may actually be clicking on content from another page. A separate report indicates that this flaw affects most Web browsers and that no fix is available, but that disabling browser scripting and plug-ins may help mitigate some of the risks.
An additional report suggests that Firefox users consider using the NoScript plug-in as an added preventative measure. Disabling IFRAMEs by default, as outlined in the Securing Your Web Browser document, is reported to protect against the vulnerability.
US-CERT says it encourages users to review the report and follow the security recommendations as described in the Securing Your Web Browser document to help mitigate some of the risks. US-CERT will provide additional information as it becomes available.
