CVE-2004-2657

Vulnerability

Mozilla Firefox 1.5.0.1 and possibly other versions stores the list of websites for which the user selected "Never Save Password" in the user profile. When Firefox is uninstalled, this profile data is not removed. If a new installation of Firefox is performed on the same Windows user account, the previously stored list of "Never Save" sites is still present and accessible via the Password Manager [1]. The vendor disputed the severity, stating that the uninstaller is intended to remove the application, not user data [1].

Exploitation

An attacker requires local access to the same Windows user account (shared profile) that was used by the victim. The victim must have used Firefox and chosen "Never Save Password" for certain websites. After the victim uninstalls Firefox, the attacker installs a new copy of Firefox on the same Windows account. Opening the Password Manager reveals the list of sites for which the victim had previously selected "Never Save" [1]. No authentication or special privileges are needed beyond local access to the user account.

Impact

The attacker gains knowledge of the specific websites the victim visited and chose not to save passwords for, potentially revealing sensitive browsing habits (e.g., dating sites, adult content). This is a privacy disclosure that can lead to personal or relationship consequences, as reported in the bug [1]. No code execution, privilege escalation, or data modification occurs.

Mitigation

The vendor closed the related bug as WONTFIX, arguing that the uninstaller is not responsible for removing user data [2]. No official patch was released. Users can manually delete the Firefox profile directory (e.g., %APPDATA%\Mozilla\Firefox\Profiles\) before uninstalling or after a fresh installation to prevent exposure [2]. Using separate Windows user accounts does not mitigate the issue if the same profile directory is reused [1].