Critical Password Flaw in Firefox and IE
Both Firefox 2 and Internet Explorer 7 are vulnerable to a flaw that could allow attackers to steal passwords. This flaw is called a Reverse Cross Site Request vulnerability (RCSR) and was discovered by Robert Chapin. The flaw compromises users' passwords and usernames by allowing a hacker to use a fake login form hosted on the same servers as the parent site.
Firefox Password Manager will automatically enter any saved passwords and usernames into the form. The data can then be sent automatically to the hacker's computer, without the user's knowledge. This flaw has already been used on MySpace, and could easily affect anyone using a blog or forum that allows user-generated HTML code to be added, fake login pages could as a result be hosted on the sites own servers, appearing to be safe to the users' browser.
For more information visit this page on Chapin Information Services, which demonstrates and explains the exploit in depth.
Firefox Password Manager will automatically enter any saved passwords and usernames into the form. The data can then be sent automatically to the hacker's computer, without the user's knowledge. This flaw has already been used on MySpace, and could easily affect anyone using a blog or forum that allows user-generated HTML code to be added, fake login pages could as a result be hosted on the sites own servers, appearing to be safe to the users' browser.
For more information visit this page on Chapin Information Services, which demonstrates and explains the exploit in depth.



