IE, Firefox Sport New Zero-Day Flaw

IE, Firefox Sport New Zero-Day Flaw

  • Legendarni građanin
  • Pridružio: 28 Apr 2003
  • Poruke: 5919
  • Gde živiš: Beograd

By Gregg Keizer

Jun 6, 2006 07:53 PM

Multiple security organizations warned Tuesday that Internet Explorer, Firefox, Mozilla, and SeaMonkey -- on Windows, Linux, and the Mac -- are vulnerable to a JavaScript bug that could allow a determined attacker to dupe users into giving up sensitive personal information such as credit card or bank account numbers and passwords.

According to Symantec, which issued an alert late afternoon Tuesday, all versions of the Microsoft and Mozilla browsers could be used to harvest data through a JavaScript key-filtering vulnerability.

"This issue is triggered by utilizing JavaScript 'OnKeyDown' events to capture and duplicate keystrokes from users," went the Symantec warning.

The bug would let crafty criminals filter keystrokes entered into a form, say a credit card form to pay for online goods, to an invisible file upload dialog on the same Web page. Once the information's trapped in that hidden dialog -- the vulnerability discoverer used the analogy of the keystrokes "bouncing" from the legit (or at least legitimate-looking form) to the cloaked one -- the data could be sent to the attacker.

"Exploiting this issue requires that users manually type the full path of files that attackers wish to download…[and] may require substantial typing from targeted users, so keyboard-based games, blogs, or other similar pages are likely to be utilized by attackers to entice users to enter the required keyboard input to exploit this issue," continued Symantec.

Danish vulnerability tracker Secunia also posted warnings of the bug Tuesday, and ranked it as "less critical," the second-from-the-bottom rating in its five-step scoring system.

The bug is unusual in that it affects not only Internet Explorer -- including fully-patched IE 6.0 and even IE 7 Beta 2 -- but also Firefox (though the most current version, the Mozilla suite, and the separately-developed successor to Mozilla, SeaMonkey. It's also out of the ordinary by virtue of its multi-platform impact: users of those browsers running Windows, Linux, and Mac OS X are vulnerable, said Symantec.

Registruj se da bi učestvovao u diskusiji. Registrovanim korisnicima se NE prikazuju reklame unutar poruka.
  • Pridružio: 11 Jun 2005
  • Poruke: 75

"Opera browser appears unaffected by this problem."

"Microsoft noted that it has not seen any malicious code that attempts to exploit the vulnerability."

Ko je trenutno na forumu

Ukupno su 836 korisnika na forumu :: 73 registrovanih, 9 sakrivenih i 754 gosta   ::   [ Administrator ] [ Supermoderator ] [ Moderator ] :: Detaljnije

Najviše korisnika na forumu ikad bilo je 3466 - dana 01 Jun 2021 17:07

Korisnici koji su trenutno na forumu:
Korisnici trenutno na forumu: A.R.Chafee.Jr., Arhiv, arzak, balkan1, Ben Roj, bojank, Boris Bosiljčić, Boter, bufanje, Cranium, darios, dejanbenkovic, djo97, drimer, Dulmitur, ekser222, famoso, goflja76, goran.vvv, Griffon vulture, Insan, ivica976, kaptain, karevski, Kriglord, krlebgd77, kunktator, Litostroton, ljuba, Mackomen, Magistar78, Malo Točeno, Markoni29, Maschinekalibar, menges, Milan A. Nikolic, milidrag1, misa1xx, Miskohd, Mixelotti, mocnijogurt, nuke92, operniki, opt1, pceklic, pein, pera12345, pristinski korpus, Profica, raskoljnikov, RJ, Rocker, rodoljub, ruseskij, S2M, savaskytec, slonic_tonic, Snorks, Stanlio, stegonosa, Stoilkovic, Tas011, theNedjeljko, time, TITAN DUDIN JARAN, tmanda323, tomigun, tvlada, vathra, Vlada1389, vsn111, wizzardone, zdrebac