Mozilla addresses “master password” security bypass flaw in Firefox

The latest update released by Mozilla for Firefox patches a flaw in Firefox Password Manager that can be exploited to access stored passwords.

The latest release for Mozilla Firefox (Firefox 68.0.2) fixes a vulnerability that can be exploited to bypass the master password in Firefox Password Manager and access stored passwords.

“When a master password is set, it is required to be entered before stored passwords can be accessed in the ‘Saved Logins’ dialog.” reads the advisory published by Mozilla. “It was found that locally stored passwords can be copied to the clipboard thorough the ‘copy password’ context menu item without first entering the master password, allowing for potential theft of stored passwords.“

The vulnerability, tracked as CVE-2019-11733, was rated as “moderate impact”

When a master password is set, it must be provided to access the saved login credentials from the Saved Logins menu. Users can see the stored passwords by pressing the “Show Passwords” button and then entering the master password.

The problem is that users could right-click on an entry and select “Copy Password” and the password would be copied to the clipboard without having to provide the master password.

The latest release solved the issue, and if a master password is set, it will be impossible to use the “Copy Password” feature without providing the master password.

Naked Security author Paul Ducklin pointed out that Firefox’s password manager has another important problem, it is turned on by default, but without a master password.

“By the way, Firefox’s password manager raises two interesting controversies even in the absence of a security problem like the one mentioned here.” reads a post published by Ducklin.

“The password manager is turned on by default, but without a master password, as you can see by doing a fresh install and then going to the Privacy & Security section on the Preferences page” “In other words, a default Firefox setup essentially suffers from the bug described in this article all the time, because there’s no master password used by default, and therefore you never need to enter one.”

[adrotate banner=”9″]

[adrotate banner=”12″]

Pierluigi Paganini

(SecurityAffairs – Mozilla Firefox, CVE-2019-11733)

[adrotate banner=”5″]

[adrotate banner=”13″]