You are currently viewing a snapshot of www.mozilla.org taken on April 21, 2008. Most of this content is highly out of date (some pages haven't been updated since the project began in 1998) and exists for historical purposes only. If there are any pages on this archive site that you think should be added back to www.mozilla.org, please file a bug.

Skip to main content

You are here: Known Vulnerabilities in Mozilla Products (Firefox 1.0.5) > MFSA 2005-54

Mozilla Foundation Security Advisory 2005-54

Title: Javascript prompt origin spoofing
Severity: Low
Reporter: Secunia.com
Products: Firefox, Mozilla Suite

Fixed in: Firefox 1.0.5
  Mozilla Suite 1.7.10

Description

Alerts and prompts created by scripts in web pages are presented with the generic title [JavaScript Application] which sometimes makes it difficult to know which site created them. A malicious page could attempt to cause a prompt to appear in front of a trusted site in an attempt to extract information such as passwords from the user.

In the fixed version these prompts will contain the hostname from the page which created it.

Workaround

Do not enter sensitive information into a "JavaScript Application" prompt, they are almost never used for this purpose. If you must, first drag the prompt on the desktop and make sure there is not a tiny window hiding behind it.

References