Security issue in Firefox

Romashka · 2006-11-24 20:15:45

Cross-Site Forms + Password Manager = Security Failure

MSIE6 is vulnerable too.
Opera is not vulnerable.
I don't know if this is an issue for Konqueror or Epiphany.

Gullible Jones · 2006-11-25 14:44:35

I think Epiphany uses its own password manager, not Firefox's, so it might not be. Konqueror I'm not sure about.

(Hmm, can't seem to find this on the bugtracker. Fixed already?)

Romashka · 2006-11-25 14:54:07

Sorry, I forgot to report it.
It's bug #5892 now.

BTW, though Opera is not vulnerable, its devs have changed the way its Wand feature works to make it even more secure.

hussam · 2006-11-25 17:55:08

Well there is no patch in https://bugzilla.mozilla.org/show_bug.cgi?id=360493
at the moment. But 2.0.0.1 should be out soon and it will include the fix for this.

iphitus · 2006-11-26 04:00:22

epiphany is vulnerable too. http://www.heise-security.co.uk/service … ass1.shtml

that's a nasty bug though. pretty much any browser that fills the forms automatically is vulnerable, allowing a malicious page to get them blindly without the user knowing -- and it's a difficult one to fix too.
You could set the password manager to remember the action url, however it could just as easily be submitted using ajax instead, while having the real action url there and thus fooling the browser. I think the best solution is an opera style fill in, requiring the user to hit the wand to login though it isnt as convenient.

James

JGC · 2006-11-26 10:50:10

The solution is quite simple: don't save passwords. Saving passwords that get autofilled is like leaving the key to your house in the lock on the outside. It's convenient, but also for others.

Until this is fixed upstream, the only possible fix is the above fix. The password manager should turn from a "leave key in the lock" feature to a feature that tells you which key you should put in the lock.

hussam · 2006-11-26 12:06:21

if it's just a case when one site can read passwords from other sites, then just have firefox match the password with the full address of the page with all the /something/whatever and not just the host name and possibly also the IP address of the site.

Namru · 2006-11-27 19:49:15

konqueror is ok

Arch Linux

#1 2006-11-24 20:15:45

Security issue in Firefox

#2 2006-11-25 14:44:35

Re: Security issue in Firefox

#3 2006-11-25 14:54:07

Re: Security issue in Firefox

#4 2006-11-25 17:55:08

Re: Security issue in Firefox

#5 2006-11-26 04:00:22

Re: Security issue in Firefox

#6 2006-11-26 10:50:10

Re: Security issue in Firefox

#7 2006-11-26 12:06:21

Re: Security issue in Firefox

#8 2006-11-27 19:49:15

Re: Security issue in Firefox

Board footer