Argument injection vulnerability in the Linden Lab Second Life
secondlife:// protocol handler, as used in Internet Explorer and
possibly Firefox, allows remote attackers to obtain sensitive
information via a '" ' (double-quote space) sequence followed by the
-autologin and -loginuri arguments, which cause the handler to post
login credentials and software installation details to an arbitrary
The login_to_simulator method in Linden Lab Second Life, as used by
the secondlife:// protocol handler and possibly other Second Life
login mechanisms, sends an MD5 hash in cleartext in the passwd field,
which allows remote attackers to login to an account by sniffing the
network and then sending this hash to a Second Life authentication
According to both Secunia and OSVDB these issues seem to be unfixed. I did not confirm this myself, but it might be worthwhile to check or contact upstream for a statement.
Joe: email@example.com is listed in metadata.xml, but does not have a bugzilla account.
1) LL Bug in their tracker: http://jira.secondlife.com/browse/VWR-2508
2) As we don't 'dobin' the register_secondlifeprotocol.sh script, so it doesn't get executed and we don't handle the secondlife:// protocol
Hi, take a look at comment #2 - I think this can be closed.
ok, closing as invalid then.