Firefox Pwd Mgr Info Disclosure - workaround available

FYI…

- http://secunia.com/advisories/23046/
Release Date: 2006-11-22
Critical: Less critical
Impact: Exposure of sensitive information
Where: From remote
Solution Status: Unpatched
Software: Mozilla Firefox 1.x, Mozilla Firefox 2.x
…This may be exploited to steal user credentials via malicious forms in the same domain.
The vulnerability is confirmed in version 2.0.0. Other versions may also be affected.
Solution: Disable the "Remember passwords for sites" option in the preferences…
Original Advisory: http://www.info-svc.com/news/11-21-2006/
Other References: https://bugzilla.mozilla.org/show_bug.cgi?id=360493 …"

FYI…

- http://isc.sans.org/diary.php?storyid=1879
Last Updated: 2006-11-22 14:43:18 UTC
"… This type of attack vector appears to also affect Internet Explorer… The workaround in this particular case would be to never use Firefox to save passwords for any web site. The option is under Tools, Options, Security. Here is a link* showing how to disable it…"
* http://www.mozilla.org/support/firefox/options#security

More…

- http://www.newsfactor.com/story.xhtml?story_id=1200044XT8ZC
November 24, 2006
"…Microsoft has also admitted that RCSR attacks -can- affect Internet Explorer, but most reports indicate that Firefox is the more likely target because of the way it stores user names and passwords. Neither Mozilla nor Microsoft has released a patch for the problem… Mozilla has indicated that it plans a fix in Firefox version 2.0.0.1 or 2.0.0.2…"

EDIT/ADD:
- http://www.sans.org/newsletters/newsbites/…mp;rss=Y#sID306

.

FYI…

- http://www.securityfocus.com/infocus/1883/2
2006-12-11
"…Risk of subversion and compromise to the password storage mechanisms of web browsers such as Internet Explorer and Firefox need further evaluation. Any system that controls the keys to the kingdom or many kingdoms should be further scrutinized. Users need to become more aware of the risks and benefits of using password management systems. Current methods of mitigation such as avoidance, immobilization, alternative storage, and password complexity are only temporary solutions. Users expect security to be transparent, usable, and secure. Thus the next generation of password management systems should take all those considerations into account for design decisions."