Mozilla

mozilla

Mozilla Foundation Security Advisory 2005-54

Javascript prompt origin spoofing

Announced
July 12, 2005
Reporter
Secunia.com
Impact
Low
Products
Firefox, Mozilla Suite
Fixed in
  • Firefox 1.0.5
  • Mozilla Suite 1.7.10

Description

Alerts and prompts created by scripts in web pages are presented with the generic title [JavaScript Application] which sometimes makes it difficult to know which site created them. A malicious page could attempt to cause a prompt to appear in front of a trusted site in an attempt to extract information such as passwords from the user.

In the fixed version these prompts will contain the hostname from the page which created it.

Workaround

Do not enter sensitive information into a "JavaScript Application" prompt, they are almost never used for this purpose. If you must, first drag the prompt on the desktop and make sure there is not a tiny window hiding behind it.

References