HTTP: Mozilla Firefox 2 Password Manager Information Disclosure

This signature detects attempts to exploit a known vulnerability against Mozilla Firefox 2. A successful attack can lead to unauthorized information disclosure.

Extended Description

Mozilla Firefox is reportedly prone to an information-disclosure weakness because it fails to properly notify users of the automatic population of form fields in disparate URLs deriving from the same domain. Exploiting this issue may allow attackers to obtain user credentials that have been saved in forms deriving from the same website where attack code resides. The most common manifestation of this condition would typically be in blogs or forums. This may allow attackers to access potentially sensitive information that would facilitate the success of phishing attacks. Initial reports and preliminary testing indicate that this issue affects only Firefox 2. UPDATE: Firefox 2.0.0.10 is still vulnerable to the issue. UPDATE (March 17, 2008): Unconfirmed reports indicate that this issue affects Firefox 2.0.0.12; we will update this BID as more information emerges.

Affected Products

Mozilla camino

References

BugTraq: 21240

CVE: CVE-2006-6077

Short Name

HTTP:STC:MOZILLA:FF2-PM-INF-DIS

Severity

Minor

Recommended

False

Recommended Action

Drop

HTTP: Mozilla Firefox 2 Password Manager Information Disclosure

Extended Description

Affected Products

References

Found a potential security threat?