Re: [Full-disclosure] New flaw found in Firefox 2.0.0.4: Firefox file input focus vulnerabilities

[Michal Zalewski <lcamtuf@xxxxxxxxxxxx>]

On Sat, 30 Jun 2007, carl hardwick wrote:

> The vulnerability allows the attacker to silently redirect focus of
> selected key press events to an otherwise protected file upload form
> field. This is possible because of how onKeyDown event is handled,
> allowing the focus to be moved between the two. This enables the
> attacker to read arbitrary files on victim's system.

Hey, that's a copy&paste from my post! ;-)

/mz

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/