Spyware Sucks
“There is no magic fairy dust protecting Macs" – Dai Zovi, author of “The Mac Hacker’s Handbook"

Password vulnerability in Firefox 2

November 22nd 2006 in Uncategorized

The vulnerability is caused due to the Password Manager not properly checking the URL before automatically filling in saved user credentials into forms. This may be exploited to steal user credentials via malicious forms in the same domain.


No patch – workaround is to turn off “Remember passwords for sites”


Once again, myspace is apparently being used to take advantage of the exploit.  When the hell are those behind myspace going to get their act together?


http://secunia.com/advisories/23046/
http://news.zdnet.com/2100-1009_22-6137844.html


Proof of concept:
http://www.info-svc.com/news/11-21-2006/rcsr1/


Zdnet says IE7 is vulnerable, but I cannot reproduce this.  The Google URL in firefox shows the password:
http://www.google.com/search?q=Chapin+Information+Services&loginuser=sam&loginpass=spade&x=&y=


IE7 does not:
http://www.google.com/search?q=Chapin+Information+Services&loginuser=&loginpass=&x=168&y=47


One comment to...
“Password vulnerability in Firefox 2”

patson dzaha

i just want to have access to his account
for some reasons


McAfee, which originally disputed SiteAdvisor’s inclusion in the 3Sharp phishing filter tests back in September have quietly changed the FAQ on their Web site, and have had to back down on their claims that they should not have been included in the phishing tests according to Computerworld:http://www.computerworld.com.au/index.php/id;838657419http://computerworld.co.nz/news.nsf/news/90CBF5D2D2CA176ACC25722E000FACA2
When the 3Sharp test results were first released, Shane […]

Previous Entry

There are several reports of the Spanish version of IE7 being downloaded instead of the English version. 
We have also seen one report of the Spanish version of IE7 being offered for install on client machines despite IE7 apparently being blocked (unconfirmed).
More information as it comes to hand will be on the WSUS blog:http://blogs.technet.com/wsus/default.aspx
Update: Bobbie Harder […]

Next Entry

Archives