Computer Security
[EN] no-pyccku

Related information

  Mozilla Firefox cleartext password leak

  Mozilla cleartext credentials leak bug report to excuse myself (Re[2]: NTLM HTTP Authentication is insecure by design - a new writeup by Amit Klein)

From:3APA3A <3APA3A_(at)>
Subject:Mozilla / Mozilla Firefox authentication weakness

Dear bugTraq,

 I  have  reported  this issue some time ago:
 but  it looks like it was ignored, and not fixed in latest mozilla and
 firefox releases, so I decided to send "formal" advisory

Issue:              Mozilla browsers authentication weakness
Author:             3APA3A <[email protected]>
Advisory URL:
Vendor:             Mozilla (
Products:           Mozilla 1.7.11 (Windows version tested)
                   FireFox 1.0.6 (Windows version tested)
Type:               Man-in-the-Middle, information leak
Exploit:            Not required

I. Intro

RFC  2617  defines  Authentication mechanism for HTTP protocol. Any web
browser implement this standard for web site access authentication.

II. Vulnerability

Firefox  and  Mozilla  browser  have  vulnerability  in  authentication
mechanism  implementation.  Potential  impact  of this vulnerability is
weak  authentication protocol (for example cleartext) may be chosen for
Web site authentication instead of stronger one.

III. Details

From RFC 2617:

  The user agent MUST
  choose to use one of the challenges with the strongest auth-scheme it
  understands and request credentials from the user based upon that

Instead,   Mozilla   uses   authentication  schemas  in  the  order  of
WWW-Authenticate  headers  sent by Web server. It may lead to situation
weak  authentication (for example cleartext "Basic" authentication) may
be  chosen  by  Mozilla  while both server and Mozilla support stronger
authentication mechanism.

IV. Demonstration

This  links  demonstrate  initial handshake for different authentication
protocols: - Basic authentication - Digest authentication - NTLM authentication - Negotiate authentication

With  this  link  you can check which protocol was chosen by browser, if
server support few authentication protocols:
For Mozilla/Firefox "Basic" authentication with cleartext login/password
transmitted  over  the  wire  will  be  chosen  by  default. By pressing
"Cancel" you can choose different authentication.

       { , . }     |\
+--oQQo->{ ^ }<-----+ \
|  ZARAZA  U  3APA3A   } You know my name - look up my number (The Beatles)
+-------------o66o--+ /

About | Terms of use | Privacy Policy
© SecurityVulns, 3APA3A, Vladimir Dubrovin
Nizhny Novgorod