A vulnerability has been identified in Mozilla Firefox, which could be exploited by remote attackers to gain knowledge of sensitive information. This isse is due to an error in the Password Manager that does not validate URLs before automatically filling in forms with saved usernames and passwords, which could be exploited by remote attackers to trick users into sending their credentials for certain web sites to a malicious page on the same domain by convincing them to visit a specially crafted Web page and perform certain actions that will cause saved usernames and passwords to be inadvertently submitted.
In sostanza, se abbiamo salvato la solita accoppiata user/password per quel determinato sito basta che qualcuno crei una pagina simile e con un url contraffatto per ingannare Firefox.
Una tecnica tanto semplice quanto efficace.
Il bug non è stato ancora risolto.
Il consiglio è quello di utilizzare sempre strumenti di antiphishing come la Netcraft toolbar
Link utili:
http://www.frsirt.com/english/advisories/2006/4662
https://bugzilla.mozilla.org/show_bug.cgi?id=360493