NetCaptor Cross-Domain Tab Window Form Field Focus Vulnerability

Bugtraq ID:	11520
Class:	Access Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Oct 25 2004 12:00AM
Updated:	Oct 25 2004 12:00AM
Credit:	Jakob Balle of Secunia Research disclosed this vulnerability.
Vulnerable:	NetCaptor NetCaptor 7.5.2
Not Vulnerable:

NetCaptor Cross-Domain Tab Window Form Field Focus Vulnerability

A cross-domain tab window form field focus vulnerability reportedly affects NetCaptor. This issue is due to an access validation error that allows a web page to gain access to form fields in other web pages rendered in different tabs of the same browser window.

This issue may be leveraged to facilitate convincing phishing style attacks designed to reveal sensitive information such as passwords and financial details.

NetCaptor Cross-Domain Tab Window Form Field Focus Vulnerability

An exploit is not required.

A proof of concept is available from the following location:

http://secunia.com/multiple_browsers_form_field_focus_test/

NetCaptor Cross-Domain Tab Window Form Field Focus Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

NetCaptor Cross-Domain Tab Window Form Field Focus Vulnerability

References:

• Multiple Browsers Tabbed Browsing Vulnerabilities (Secunia)
  
• NetCaptor Home Page (NetCaptor)
  
• Netcaptor Tabbed Browsing Vulnerabilities (Secunia)