New High Risk Security Flaw Found in All Versions of Internet Explorer, Firefox

[mandy]

  Multiple security organizations warned Tuesday that Internet Explorer, Firefox, Mozilla, and SeaMonkey -- on Windows, Linux, and the Mac -- are vulnerable to a JavaScript bug that could allow a determined attacker to dupe users into giving up sensitive personal information such as credit card or bank account numbers and passwords.

According to Symantec, which issued an alert late afternoon Tuesday, all versions of the Microsoft and Mozilla browsers could be used to harvest data through a JavaScript key-filtering vulnerability.

"This issue is triggered by utilizing JavaScript 'OnKeyDown' events to capture and duplicate keystrokes from users," went the Symantec warning...

full article: http://informationweek.com/news/showArti...=188702223

[bargainbloodhound]

http://secunia.com/advisories/20442/
http://secunia.com/advisories/20449/
http://lists.grok.org.uk/pipermail/full-...46610.html