Big Flaw in Firefox 2: Password Manager Bug Exposes Passwords Nov 22 2006 09:57AM
fash1on gmail com (1 replies)
"Today, Mozilla made public bug #360493, which exposes Firefox's Password Manager on many public sites. The flaw derives from Firefox's willingness to supply the username and password stored on one page on a domain to another page on a domain. For example, username/password input tags on a Myspace user's site will be unhelpfully propagated with the visitor's Myspace.com credentials. It was first discovered in the wild by Netcraft on Oct. 27. As this proof-of-concept illustrates, because the username/password fields need not be visible on the page, your password can be stolen in an almost completely transparent fashion.
PoC here: http://www.info-svc.com/news/11-21-2006/rcsr1/

[ reply ]
Re: Big Flaw in Firefox 2: Password Manager Bug Exposes Passwords Nov 23 2006 04:04PM
3APA3A (3APA3A SECURITY NNOV RU)


 

Privacy Statement
Copyright 2010, SecurityFocus