bugtraq - Password Flaw also in Firefox 1.5.08. Was: Big Flaw in Firefox 2: Password Manager Bug Exposes Passwords

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <B3BCAF4246A8A84983A80DAB50FE72427DE355@secnap2.secnap.com>
Date: Thu, 23 Nov 2006 08:13:10 -0500
From: "Michael Scheidell" <scheidell@...nap.net>
To: <fash1on@...il.com>, <bugtraq@...urityfocus.com>
Cc: <first-alerts@...tserver.hackertrap.net>
Subject: Password Flaw also in Firefox 1.5.08. Was: Big Flaw in Firefox 2: Password Manager Bug Exposes Passwords

> -----Original Message-----
> From: fash1on@...il.com [mailto:fash1on@...il.com] 
> Sent: Wednesday, November 22, 2006 4:58 AM
> Subject: Big Flaw in Firefox 2: Password Manager Bug Exposes Passwords
> 
> 
> "Today, Mozilla made public bug #360493, which exposes 
> Firefox's Password Manager on many public sites. The flaw 
> derives from Firefox's willingness to supply the username and 
> password stored on one page on a domain to another page on a 
> domain. For example, username/password input tags on a 
> Myspace user's site will be unhelpfully propagated with the 
> visitor's Myspace.com credentials. It was first discovered in 
> the wild by Netcraft on Oct. 27. As this proof-of-concept 
> illustrates, because the username/password fields need not be 
> visible on the page, your password can be stolen in an almost 
> completely transparent fashion. PoC here: 
> http://www.info-svc.com/news/11-21-2006/rcsr1/
> 

Looks like this also affects FireFox 1.5.08.