Mozilla Foundation Security Advisory 2005-54
Javascript prompt origin spoofing
- Announced
- July 12, 2005
- Reporter
- Secunia.com
- Impact
- Low
- Products
- Firefox, Mozilla Suite
- Fixed in
-
- Firefox 1.0.5
- Mozilla Suite 1.7.10
Description
Alerts and prompts created by scripts in web pages are presented with the generic title [JavaScript Application] which sometimes makes it difficult to know which site created them. A malicious page could attempt to cause a prompt to appear in front of a trusted site in an attempt to extract information such as passwords from the user.
In the fixed version these prompts will contain the hostname from the page which created it.
Workaround
Do not enter sensitive information into a "JavaScript Application" prompt, they are almost never used for this purpose. If you must, first drag the prompt on the desktop and make sure there is not a tiny window hiding behind it.