Password-Phishing hole in Iceweasel, Firefox, Mozilla

craigevil · 11-22-2006, 05:49 PM

Huge password-phishing hole in the mozilla family. The demo works "great" here with iceweasel and mozilla:
http://www.heise-security.co.uk/serv...password=test#

First exploits are reported from myspace.com

More here:
http://www.heise-security.co.uk/news/81419

unSpawn · 11-23-2006, 04:33 AM

Good one. Didn't work for me since JS wasn't enabled for the site (FF-1.5.0.7+Noscript+Privoxy) but the site clearly states disabling JS doesn't mean it's not vulnerable. Reading https://bugzilla.mozilla.org/show_bug.cgi?id=360493 gives more examples (also it seems this got reported aprox ten days ago). FF devs appear (IMHO) to be more concerned with fscking up their UI / release schedule than fixing this in the next release.

Crito · 11-23-2006, 08:44 AM

Bugzilla thread says works with Internet Explorer too. Looks like Opera is only browser with a secure default behavior.