Password-exposing bug purged from LastPass extensions

'Developers of the LastPass password manager have patched a
vulnerability that made it possible for websites to steal credentials
for the last account the user logged into using the Chrome or Opera
extension.

The vulnerability was discovered late last month by Google Project
Zero researcher Tavis Ormandy, who privately reported it to LastPass.
In a write-up that became public on Sunday, Ormandy said the flaw
stemmed from the way the extension generated popup windows. In certain
situations, websites could produce a popup by creating an HTML iframe
that linked to the Lastpass popupfilltab.html window rather than
through the expected procedure of calling a function called
do_popupregister(). In some cases, this unexpected method caused the
popups to open with a password of the most recently visited site.'

-- source: https://arstechnica.com/information-technology/2019/09/lastpass-fixes-bug-that-leaked-the-password-of-last-logged-in-account/

Cheers, Peter
-- 
Peter Reutemann
Dept. of Computer Science
University of Waikato, NZ
+64 (7) 858-5174
http://www.cms.waikato.ac.nz/~fracpete/
http://www.data-mining.co.nz/
_______________________________________________
wlug mailing list -- [email protected] | To unsubscribe send an email to [email protected]
Unsubscribe: %(web_page_url)slistinfo%(cgiext)s/%(_internal_name)s