Loading
-
IE 7 Less Vulnerable than Firefox 2?
Techtree News Staff, Nov 23, 2006 1706 hrs ISTMozilla Firefox 2 and Microsoft Internet Explorer 7 (IE) are both vulnerable to a bug that steals the login-id and password of users...
According to reports, Mozilla Firefox 2 and Microsoft Internet Explorer 7 (IE) are both vulnerable to a bug that steals the login-id and password of users, with the help of a fake log-in page.
The bug has been dubbed as "Reverse Cross Site Request vulnerability" (RCSR) by Robert Chapin, who first discovered the flaw.
Reportedly, the attack was first carried out from a profile page using a specially crafted HTML that hides the genuine MySpace content from the page, and displays the fake login page instead. The fake page is then sent to another Web site, along with information regarding MySpace users who visited the page using Firefox.
The attacks seen on My Space.com are likely to move on to Firefox as well because the Firefox Password Manager automatically enters any saved passwords and user-id/s into the form, whereas IE is not capable of filling in the saved information automatically.
Therefore, Firefox is more likely to get affected by the flaw, as compared to IE.
According to Chapin, users of both Firefox and IE need to be aware that their information can be stolen in this way when visiting blog and forum Web sites at trusted addresses as well. Further, an RCSR attack is more likely to succeed than an XSS attack because neither IE nor Firefox are designed to check the destination of form data before the user submits them.
Moreover, the browser doesn't indicate the exploitation as it is conducted on a trusted Web site.
As of now, no fix has been issued by Mozilla, and it's not very clear if the other versions of Firefox are also affected by the flaw. Users have been advised to disable the "Remember passwords for sites" from the preference link in Firefox.
Additionally, these attacks could also be highly effective against firewall of local network servers and HTTPS addresses that are not otherwise accessible because the attacker does not need direct access.
The bug has been dubbed as "Reverse Cross Site Request vulnerability" (RCSR) by Robert Chapin, who first discovered the flaw.
Reportedly, the attack was first carried out from a profile page using a specially crafted HTML that hides the genuine MySpace content from the page, and displays the fake login page instead. The fake page is then sent to another Web site, along with information regarding MySpace users who visited the page using Firefox.
The attacks seen on My Space.com are likely to move on to Firefox as well because the Firefox Password Manager automatically enters any saved passwords and user-id/s into the form, whereas IE is not capable of filling in the saved information automatically.
Therefore, Firefox is more likely to get affected by the flaw, as compared to IE.
According to Chapin, users of both Firefox and IE need to be aware that their information can be stolen in this way when visiting blog and forum Web sites at trusted addresses as well. Further, an RCSR attack is more likely to succeed than an XSS attack because neither IE nor Firefox are designed to check the destination of form data before the user submits them.
Moreover, the browser doesn't indicate the exploitation as it is conducted on a trusted Web site.
As of now, no fix has been issued by Mozilla, and it's not very clear if the other versions of Firefox are also affected by the flaw. Users have been advised to disable the "Remember passwords for sites" from the preference link in Firefox.
Additionally, these attacks could also be highly effective against firewall of local network servers and HTTPS addresses that are not otherwise accessible because the attacker does not need direct access.
Related Links
Tag keywords
Discussion Board
(29) Comments
жо&
,NY, on Nov 21, 2007 05:33 PM
Report abuse
LARRY G
,WAUKESHA, on Nov 23, 2006 07:39 PM
UnHoly
,Miami, on Nov 26, 2006 09:55 AM
pat
,Anchorage Alaska, on Jan 06, 2007 11:00 AM
Senthil Kumar
,Chennai, on Nov 23, 2006 08:27 PM
gffff
,ds, on Nov 30, 2006 04:24 PM
Andrew
,US, on Nov 23, 2006 07:13 PM
your moma
,somehwere, on Nov 24, 2006 01:24 PM
zimmer
,London, on Nov 24, 2006 07:42 PM
gtirebiter
,New York, on Nov 24, 2006 09:32 PM
Andrew
,mumbai, on Nov 30, 2006 02:18 PM
Ken
,Eugene, on Nov 25, 2006 04:36 AM
James
,None, on Nov 25, 2006 07:49 AM
Upendran
,Chennai, on Nov 24, 2006 07:27 PM
david
,waverly, on Nov 24, 2006 12:42 PM
Dale
,Bowling Green, on Nov 24, 2006 12:18 AM
henry
,montreal, on Nov 24, 2006 06:36 AM
Aaron
,Auckland, on Nov 24, 2006 05:19 AM
Matthew Archer
,Oxnard, CA, on Nov 24, 2006 02:17 AM
Gloria
,Denver, on Nov 24, 2006 02:16 AM
shaharyar rao
,islamabad, on Nov 23, 2006 06:15 PM
Opinion Poll
- Which desktop web browser do you use?
-
Internet Explorer
Firefox
Chrome
Safari
Opera
Other (specify in comments)
Poll Results View Previous Polls