A vulnerability has been identified in various web brosers, which could be exploited by remote attackers to gain knowledge of sensitive information. This isse is due to an error in the password management feature that does not validate URLs before automatically filling in forms with saved usernames and passwords, which could be exploited by remote attackers to trick users into sending their credentials for certain web sites to a malicious page on the same domain by convincing them to visit a specially crafted Web page and perform certain actions that will cause saved usernames and passwords to be inadvertently submitted.
Credits
Vulnerability reported by Robert Chapin
ChangeLog
2006-11-22 : Initial release
Vulnerability Management
Subscribe to FrSIRT VNS and receive real-time e-mail and SMS alerts when new vulnerabilities, exploits, or patches relevant to your systems and network configurations are available.
Feedback
If you have additional information or corrections for this security advisory please submit them via our contact form or by email to updates@frsirt.com.
French
