CIS declares Firefox Password Manager unsafe
MySpace details may be compromised in unpatched flaw
29 January 2007 17:34 GMT / By Amber Maitland
CIS is reporting today that efforts by MySpace to fix a flaw that tricks users into entering their login details in to a bogus web page have failed.
CIS said that a Reverse Cross Site Request can still be injected into a MySpace.com email message.
News of the flaw first broke on 23 November, when CIS warned Firefox 2 and IE7 users to be careful of the vulnerability, which allows attackers to get users' login details by showing them a fake login form.
This tricks Firefox Password Manager into filling in the saved details. CIS reviewed the vulnerability on 19 January, after Firefox version 2.0.0.1 was released, but the version didn't contain a fix.
CIS is therefore warning users to disable the Password Manager so that they don't fall prey to a malicious bogus webpage.
CAMERAS
Next-gen Flip camcorder to boast Wi-Fi EXCLUSIVE: Cisco buy-out sees networking functionality added to popular range
CAMERAS
Canon PowerShot S90 digital camera How much fun can you pack into a compact?
GADGETS
Robolamps revealed Robotic lighting creations from Croatia
Comments