Home page logo

fulldisclosure logo Full Disclosure mailing list archives

Re: New flaw found in Firefox Firefox file input focus vulnerabilities
From: Michal Zalewski <lcamtuf () dione ids pl>
Date: Sat, 30 Jun 2007 23:03:29 +0200 (CEST)

On Sat, 30 Jun 2007, carl hardwick wrote:

The vulnerability allows the attacker to silently redirect focus of
selected key press events to an otherwise protected file upload form
field. This is possible because of how onKeyDown event is handled,
allowing the focus to be moved between the two. This enables the
attacker to read arbitrary files on victim's system.

Hey, that's a copy&paste from my post! ;-)


Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]