CVE-2007-4960 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-4960): Argument injection vulnerability in the Linden Lab Second Life secondlife:// protocol handler, as used in Internet Explorer and possibly Firefox, allows remote attackers to obtain sensitive information via a '" ' (double-quote space) sequence followed by the -autologin and -loginuri arguments, which cause the handler to post login credentials and software installation details to an arbitrary URL. CVE-2007-4961 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-4961): The login_to_simulator method in Linden Lab Second Life, as used by the secondlife:// protocol handler and possibly other Second Life login mechanisms, sends an MD5 hash in cleartext in the passwd field, which allows remote attackers to login to an account by sniffing the network and then sending this hash to a Second Life authentication server.
According to both Secunia and OSVDB these issues seem to be unfixed. I did not confirm this myself, but it might be worthwhile to check or contact upstream for a statement. Joe: toei.rei@stargazer.at is listed in metadata.xml, but does not have a bugzilla account.
1) LL Bug in their tracker: http://jira.secondlife.com/browse/VWR-2508 2) As we don't 'dobin' the register_secondlifeprotocol.sh script, so it doesn't get executed and we don't handle the secondlife:// protocol
Hi, take a look at comment #2 - I think this can be closed.
ok, closing as invalid then.