• Home
  • Apps
  • Apps News
  • LastPass Password Manager Affected by Multiple Security Flaws, Researcher Reveals

LastPass Password Manager Affected by Multiple Security Flaws, Researcher Reveals

Share on Facebook Tweet Share Reddit Comment
LastPass Password Manager Affected by Multiple Security Flaws, Researcher Reveals
Highlights
  • LastPass has resolved one vulnerability since the report
  • Two reported vulnerabilities remain to be patched
  • LastPass is working on one, has yet to acknowledge the other

Password management service LastPass is no stranger to vulnerabilities, from an autofill vulnerability just earlier this year to a major breach back in 2015 and numerous flaws reported in the interim. Now, Google Project Zero researcher Tavis Ormandy has reported three separate vulnerabilities in the service, one of which LastPass claims to have resolved.

The resolved vulnerability could have allowed attackers to perform remote code executions (if using the binary component), apart from stealing passwords, and affected Chrome and Firefox users utilising LastPass v4.1.42. LastPass claims this has been resolved, and Ormandy himself has marked the issue as fixed on the Project Zero site.

Update: LastPass says it has resolved the vulnerabilities pointed out by Tavis Ormandy. It claims users will not need to change their master password or any site credential passwords, but users must ensure they are running the latest versions of the LastPass - found on its download page. It also claims the v4.1.42 and v4.1.35 vulnerabilities were caused by the same issue, which has been resolved. Ormandy in a tweet commended the LastPass team for the speed of the resolutions.

As for the other two vulnerabilities, one affects an old LastPass add-on (v3.3.2) on Firefox that LastPass earlier this month said it is considering retiring, though after the vulnerability was reported by Ormandy it said it is working on a resolution. Ormandy refers to it as a quick exploit, implying it was easy to find and use.

The last LastPass vulnerability uncovered by Ormandy appears to be referring to an Internet Explorer add-on (v4.1.35) as Engadget points out. LastPass is yet to respond to this report by Ormandy.

With these many vulnerabilities reported in under a week, it’s quite apparent LastPass is on high alert, and could do with an extensive audit of its services. As we mentioned, this certainly isn’t the first time the password management service has been under fire, and Ormandy himself uncovered a major flaw last year.

Security is certainly not easy, but when you are responsible for managing the passwords for millions of users, staying on top of your game is paramount. Ormandy advises using KeePass or KeePassX password managers. Password management services built into browsers like Chrome, Firefox, Safari, and Opera are themselves not immune, so unless you start to follow security best practices to create and remember passwords, staying safe could be difficult.

Comments

For the latest tech news and reviews, follow Gadgets 360 on Twitter, Facebook, and subscribe to our YouTube channel.

Gadgets 360 Staff The resident bot. If you email me, a human will respond. More
Mass Effect: Andromeda - Day One Patch, Price, Download Size, PC Requirements, and More
OnePlus 3T Midnight Black Limited Edition Launched; India Price, Release Date Announced
 
 

Advertisement

 

Advertisement

© Copyright Red Pixels Ventures Limited 2019. All rights reserved.