Members Login
Username 
 
Password 
    Remember Me  
CAPP -> CAPP -> Spoofing vulnerability in Firefox & Password Manager Bug
Post Info TOPIC: Spoofing vulnerability in Firefox & Password Manager Bug
anonymous


Top Poster

Status: Offline
Posts: 1446
Date:
Spoofing vulnerability in Firefox & Password Manager Bug
Permalink  

Spoofing vulnerability in Firefox
Report of 12.03.2007 11:13 [<< previous] [next >>]
Spoofing vulnerability in Firefox

 

A design error in the Firefox browser can allow phishers to conceal the true origins of a web page from the user. This could be used to place extremely deceptively genuine looking web pages from organisations such as banks, eBay, PayPal and other providers on the web (spoofing). Browser security specialist Michal Zalewski has provided a demonstration web page to enable interested users to understand the problem. The demo works with Firefox 1.5 and 2.0.

According to Zalewski, the problem lies in the way Firefox deals with the URL about:blank, which opens a blank page. The browser does not show either a URL in the address bar or information in the window's title bar. However, JavaScript can also open such a web page, and various JavaScript functions can be used to insert additional content into the web page. This is not normally possible for windows originating from different domains, but because about:blank is not assigned to any domain and document.location is not defined, it nevertheless works anyway. And, according to Zalewski, older spoofing bugs can also again be exploited in this way in Firefox.

The only remedy at present is to disable JavaScript or to use the NoScript plugin for Firefox, which only allows scripting on known, trusted websites.

See also:

(ehe


(BOLDING MINE)




-- Edited by anonymous at 08:04, 2007-03-12

__________________
CAPP Consumers Against PayPal Policies - Exposing the sleazery of sleazebay and painpal
anonymous


Top Poster

Status: Offline
Posts: 1446
Date:
RE: Spoofing vulnerability in Firefox
Permalink  

Get Firefox, with Adblock Plus, and NoScript. Get more themes and extensions

__________________
CAPP Consumers Against PayPal Policies - Exposing the sleazery of sleazebay and painpal
anonymous


Top Poster

Status: Offline
Posts: 1446
Date:
Permalink  

There is no panic breaking out over at the mozillazine support forums.

Everyone knows (or should know) to surf with no scripts allowed.

Without even checking, I would bet that IE does the same thing. (and worse)
Be sure to visit the test page there in the OP article.

__________________
CAPP Consumers Against PayPal Policies - Exposing the sleazery of sleazebay and painpal
anonymous


Top Poster

Status: Offline
Posts: 1446
Date:
RE: Spoofing vulnerability in Firefox & Password Manager Bug
Permalink  

Firefox Password Management bug

Last November, Robert Chapin found a new security hole in Firefox, dubbing it ’Reverse Cross-Site Request (RCSR). It exposed saved passwords and could affect anyone visiting a weblog or forum website that allows user-contributed HTML codes to be added, said Chapin.

 

 

Then in January this year, the risks meant Firefox Password Manager should immediately be disabled, he warned.

 

Now Chapin, who runs Chapin Information Services, tells p2pnet an analysis he’s just finished concludes the February 23 release of Firefox version 2.0.0.2 handles less than 25% of the problems related to Bug #360493, as it’s been labelled, although the fixes will, "satisfy the current security needs of the average Internet user".

 

Chapin’s charts below are divided into lists of risk factors, "that may contribute to the overall success or failure of Password Management," he says, going on:

 

"Each risk is assigned a weight from zero to five such that zero means no risk and five means relatively high risk.

 

"A discussion of each risk follows the analysis tables. Where this document mentions risks that are not yet disclosed to the public, only status information will be given."

URL TRACKBACK : http://www.agoravox.com/tb_receive.php3?id_article=5666


__________________
CAPP Consumers Against PayPal Policies - Exposing the sleazery of sleazebay and painpal
anonymous


Top Poster

Status: Offline
Posts: 1446
Date:
Spoofing vulnerability in Firefox & Password Manager Bug
Permalink  

Look for FF to be on the case and most likely have an update within a couple days.



__________________
CAPP Consumers Against PayPal Policies - Exposing the sleazery of sleazebay and painpal
budnonymous


Top Poster

Status: Offline
Posts: 3757
Date:
RE: Spoofing vulnerability in Firefox & Password Manager Bug
Permalink  

The fix is in 

V2.xxx just update

V1.5xxx go here for windows,

go here for mac

Look on my blog for some good FF extensions



__________________

Exposing the sleazery of ebaY and PayPal

 
Page 1 of 1  sorted by
 
Quick Reply

Please log in to post quick replies.
CAPP -> CAPP -> Spoofing vulnerability in Firefox & Password Manager Bug
Tweet this page Post to Digg Post to Del.icio.us


Create your own FREE Forum
Report Abuse 		Powered by ActiveBoard