Mozilla addresses “master password” security bypass flaw in Firefox

The latest update released by Mozilla for Firefox patches a flaw in Firefox Password Manager that can be exploited to access stored passwords.

The latest release for Mozilla Firefox (Firefox 68.0.2) fixes a vulnerability that can be exploited to bypass the master password in Firefox Password Manager and access stored passwords.

“When a master password is set, it is required to be entered before stored passwords can be accessed in the ‘Saved Logins’ dialog.” reads the advisory published by Mozilla. “It was found that locally stored passwords can be copied to the clipboard thorough the ‘copy password’ context menu item without first entering the master password, allowing for potential theft of stored passwords.“

The vulnerability, tracked as CVE-2019-11733, was rated as “moderate impact”

When a master password is set, it must be provided to access the saved login credentials from the Saved Logins menu. Users can see the stored passwords by pressing the “Show Passwords” button and then entering the master password.

The problem is that users could right-click on an entry and select “Copy Password” and the password would be copied to the clipboard without having to provide the master password.

The latest release solved the issue, and if a master password is set, it will be impossible to use the “Copy Password” feature without providing the master password.

Naked Security author Paul Ducklin pointed out that Firefox’s password manager has another important problem, it is turned on by default, but without a master password.

“By the way, Firefox’s password manager raises two interesting controversies even in the absence of a security problem like the one mentioned here.” reads a post published by Ducklin.

“The password manager is turned on by default, but without a master password, as you can see by doing a fresh install and then going to the Privacy & Security section on the Preferences page” “In other words, a default Firefox setup essentially suffers from the bug described in this article all the time, because there’s no master password used by default, and therefore you never need to enter one.”

[adrotate banner=”9″]

[adrotate banner=”12″]

Pierluigi Paganini

(SecurityAffairs – Mozilla Firefox, CVE-2019-11733)

[adrotate banner=”5″]

[adrotate banner=”13″]

Pierluigi Paganini

Pierluigi Paganini is member of the ENISA (European Union Agency for Network and Information Security) Threat Landscape Stakeholder Group and Cyber G7 Group, he is also a Security Evangelist, Security Analyst and Freelance Writer. Editor-in-Chief at "Cyber Defense Magazine", Pierluigi is a cyber security expert with over 20 years experience in the field, he is Certified Ethical Hacker at EC Council in London. The passion for writing and a strong belief that security is founded on sharing and awareness led Pierluigi to find the security blog "Security Affairs" recently named a Top National Security Resource for US. Pierluigi is a member of the "The Hacker News" team and he is a writer for some major publications in the field such as Cyber War Zone, ICTTF, Infosec Island, Infosec Institute, The Hacker News Magazine and for many other Security magazines. Author of the Books "The Deep Dark Web" and “Digital Virtual Currency and Bitcoin”.