full-disclosure - Firefox 2.0.0.11 File Focus Stealing vulnerability

lists.openwall.net		lists / announce john-users owl-users popa3d-users / xvendor oss-security / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4
Open Source and information security mailing list archives

Order Openwall GNU/*/Linux 2.0 on a CD with delivery worldwide

[<prev] [next>] [month] [year] [list]

Date: Sat, 1 Dec 2007 14:48:35 +0100
From: "carl hardwick" <hardwick.carl@...il.com>
To: full-disclosure@...ts.grok.org.uk
Subject: Firefox 2.0.0.11 File Focus Stealing vulnerability

Firefox 2.0.0.11 File Focus Stealing vulnerability:

Sorry Mozilla, but the recent file focus fix was not enough. I think
Mozilla made another mistake while fixing the previous file/label
issue. Because now I embed a file field and a textfield inside one
label. When this happens, and you type only one time in the textfield,
the focus travels to the file field and the value travels with it.
Back to the drawing board I would say. I only got it to work in
Firefox, Gareth checked Safari for me, and it also works in Safari. I
guess this type of exploit could function on other HTML objects as
well, and could be very dangerous because it only requires a one time
focus in a textfield.

PoC here:
http://carl-hardwick.googlegroups.com/web/Firefox20011StealFocusFlaw.htm

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/