> Firefox "OnKeyDown" Event Focus Weakness
> SECUNIA ADVISORY ID:
> VERIFY ADVISORY:
> Not critical
> Exposure of sensitive information
> From remote
> Mozilla Firefox 1.x
> Mozilla Firefox 2.0.x
> Carl Hardwick has discovered a weakness in Firefox, which potentially
> can be exploited by malicious people to disclose sensitive
> The weakness is caused due to a design error within the focus
> handling of form fields and can potentially be exploited by changing
> the focus from a "textarea" field to a "file upload" form field via
> the "OnKeyDown" event.
> Successful exploitation allows an arbitrary file on the user's system
> to be uploaded to a malicious web site, but requires that the user is
> tricked into typing the file name into a "textarea" input form.
> The weakness is confirmed in version 18.104.22.168. Other versions may also
> be affected.
> Do not enter file names to form fields on untrusted web sites.
> PROVIDED AND/OR DISCOVERED BY:
> Carl Hardwick
> ORIGINAL ADVISORY: