OSVDB ID: 10984

Title: Multiple Browser Cross Tab Form Focus

Info

Disclosure

Oct 20, 2004

Discovery

Oct 04, 2004

Dates

Exploit

Oct 20, 2004

Solution

Unknown

Description

Mozilla Web Browser, Firefox, Netscape, Maxthon and Avant Browser contain a flaw that may allow a malicious user to gain confidential data by shifting focus on forms from an active tab to an inactive tab. The issue is triggered when a user visits a specially crafted URL that may allow inactive tabs to gain focus from form fields on web sites in another tab resulting in a loss of confidentiality.

Classification

Location: Remote / Network Access
Attack Type: Input Manipulation
Impact: Loss of Confidentiality
Exploit: Exploit Public

Solution

Currently, there are no known upgrades or patches to correct this issue. It is possible to correct the flaw by implementing the following workaround(s): disable JavaScript.

Products

Mozilla Organization	Mozilla Web Browser	1.7.3
Mozilla Organization	Firefox	0.10.1

Netscape Communications Corporation

Netscape

7.2

Mysoft Technology

Maxthon

1.1.039

Avant Force

Avant Browser

10.0 build 029

Stilesoft Inc.

NetCaptor

7.5.2

FlashPeak

Slim Browser

4.01.003

Galeon

Galeon

1.3.18

GNOME Epiphany Project

Epiphany

1.4.4

References

Security Tracker: 1011922
Related OSVDB ID: 10983
Secunia Advisory ID: 12712 12714 12717 12731 12966 12983 14709 14714
CVE ID: 2004-1380 (see also: NVD) 2004-1381 (see also: NVD)
Milw0rm: 589
Exploit Database: 589
SCIP VulDB ID: 917
Keyword: aka the "Dialog Box Spoofing Vulnerability" MFSA 2005-05
Generic Exploit URL: http://secunia.com/multiple_browsers_form_field_focus_test/
Other Advisory URL: http://secunia.com/secunia_research/2004-10/
http://slackware.com/security/viewer.php?l=slackware-security&y=2005&m=slackware-security.000123
Vendor Specific Advisory URL: http://www.mozilla.org/security/announce/mfsa2005-05.html
RedHat RHSA: RHSA-2005:323

Credit

Jakob Balle - jbsecunia.com - Secunia Research

Direct URL: http://osvdb.org/10984