Bug 188804

Summary:	CVE-2006-1729 File stealing by changing input type
Product:	[Fedora] Fedora	Reporter:	Josh Bressers <bressers>
Component:	mozilla	Assignee:	Christopher Aillon <caillon>
Status:	CLOSED ERRATA	QA Contact:	Ben Levenson <benl>
Severity:	medium	Docs Contact:
Priority:	medium
Version:	5	CC:	deisenst, security-response-team
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:	reported=20060412,source=mozilla,embargo=yes,impact=moderate
Fixed In Version:	FEDORA-2006-487	Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2006-06-24 16:27:54 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Josh Bressers 2006-04-13 02:28:50 UTC

File stealing by changing input type


Claus JÃ¸rgensen reports that a text input box can be pre-filled with a
filename  and then turned into a file-upload control with the contents
intact, allowing a malicious website the ability to steal any local file
whose name they can guess.

Jesse Ruderman reports a variation, changing the type of the input control
in an event handler to work around some of the initial checks.

Workaround

Upgrade to fixed version.

References

[1]https://bugzilla.mozilla.org/show_bug.cgi?id=325947
[2]https://bugzilla.mozilla.org/show_bug.cgi?id=328566


This issue also affects FC4

Comment 1 Josh Bressers 2006-04-24 12:49:14 UTC

Lifting embargo

Comment 2 David Eisenstein 2006-06-24 16:27:54 UTC

This bug was fixed for FC4 in Fedora Update FEDORA-2006-488
<http://www.redhat.com/archives/fedora-package-announce/2006-May/msg00019.html>.

This bug was fixed for FC5 in Fedora Update FEDORA-2006-487
<http://www.redhat.com/archives/fedora-package-announce/2006-May/msg00018.html>.