Mozilla Foundation’s open source browser, Firefox, has warned users of a security flaw that gives away passwords and names of users, to other visitors on the browser. Internet explorer 7 also, reportedly has the same flaw, known as the Reverse Cross-Site Request (RCSR).
The flaw lets hackers access passwords and usernames by presenting them with a fake login form. In turn, Firefox Password Manager enters any saved passwords and usernames into that form. As a result, the data is automatically sent to an attacker’s computer without the user’s knowledge. This flaw has already been exploited on social-networking site MySpace, and it could affect anyone using a blog or forum that allows user-generated HTML code to be added.
Although Mozilla has not issued a fix, a bug report has been filed. Mozilla has suggested that users should avoid using Password Manager and the Master Password Timeout Firefox extension. Also, Security company Secunia has advised users to disable the ‘Remember passwords for sites’ option in Firefox.
Read more here.


)
)
)
)
)
)
)
)
