Re: IE 5.0 vulnerability

[davids () WEBMASTER COM (David Schwartz)]

    This has nothing to do with cookies. It's autocompletion. The two
technologies are entirely unrelated.

        DS

-----Original Message-----
From: VULN-DEV List [mailto:VULN-DEV () SECURITYFOCUS COM]On Behalf Of Josh
Burns
Sent: Friday, October 22, 1999 2:20 PM
To: VULN-DEV () SECURITYFOCUS COM
Subject: IE 5.0 vulnerability

I'm not sure if this has been announced yet, but here goes..  I am not sure
if this is an IE 5 problem, or not, but when you have cookies enabled
(default setting), and you use a service like AOLMail, Hotmail, or anything
that requires a name and password, it is stored in a cookie for later use.
If the user closes IE, and then reopens it, and goes to the same page, and
type in the first letter of their login name, a drop-down box will come up,
with their user name in it, and you can click it.  Then, if the user clicks
on the password field, it automatically fills in their password.  I'm not
sure what the cookie for this looks like, if the stored password is
encrypted, or not, because I didn't have time to test.  This can most likely
be fixed by going to Internet Options, and turning off cookies from all
hosts.  Please give me some feedback on this.

Josh Burns