Vulnerability Development mailing list archives
IE 5.0 vulnerability
From: jburns () BITSTREAMNETWORKS COM (Josh Burns)
Date: Fri, 22 Oct 1999 17:20:21 -0400
I'm not sure if this has been announced yet, but here goes.. I am not sure if this is an IE 5 problem, or not, but when you have cookies enabled (default setting), and you use a service like AOLMail, Hotmail, or anything that requires a name and password, it is stored in a cookie for later use. If the user closes IE, and then reopens it, and goes to the same page, and type in the first letter of their login name, a drop-down box will come up, with their user name in it, and you can click it. Then, if the user clicks on the password field, it automatically fills in their password. I'm not sure what the cookie for this looks like, if the stored password is encrypted, or not, because I didn't have time to test. This can most likely be fixed by going to Internet Options, and turning off cookies from all hosts. Please give me some feedback on this. Josh Burns <!-- body="end" --> <HR> <UL> <LI><STRONG>Next message:</STRONG> Blue Boar: "Administrivia #2808" <LI><STRONG>Previous message:</STRONG> Ofir Arkin: "Re: Classes?" <LI><STRONG>Next in thread:</STRONG> Blue Boar: "Re: IE 5.0 vulnerability" <LI><STRONG>Reply:</STRONG> Blue Boar: "Re: IE 5.0 vulnerability" <LI><STRONG>Reply:</STRONG> David Schwartz: "Re: IE 5.0 vulnerability" <LI><STRONG>Reply:</STRONG> David U.: "Re: IE 5.0 vulnerability" <LI><STRONG>Reply:</STRONG> Josh Burns: "Re: IE 5.0 vulnerability" <LI><STRONG>Reply:</STRONG> Mike Malouf: "Re: IE 5.0 vulnerability" <LI><STRONG>Reply:</STRONG> -wb: "Re: IE 5.0 vulnerability" </UL> <HR> <SMALL> This archive was generated by hypermail 2.0b3 on Sun Oct 24 1999 - 12:29:32 CDT</EM> </EM> </SMALL> </BODY> </HTML>
Current thread:
- IE 5.0 vulnerability Josh Burns (Oct 22)
- Re: IE 5.0 vulnerability David Schwartz (Oct 24)
- Re: IE 5.0 vulnerability Blue Boar (Oct 24)
- Re: IE 5.0 vulnerability David U. (Oct 24)
- Re: IE 5.0 vulnerability Mike Malouf (Oct 25)
- <Possible follow-ups>
- Re: IE 5.0 vulnerability Josh Burns (Oct 24)
- Re: IE 5.0 vulnerability -wb (Oct 26)
- Re: IE 5.0 Vulnerability Bill Weiss (Oct 26)