Search

LastPass Password Manager Affected by Multiple Security Flaws, Researcher Reveals

Advertisement
Highlights
  • LastPass has resolved one vulnerability since the report
  • Two reported vulnerabilities remain to be patched
  • LastPass is working on one, has yet to acknowledge the other
LastPass Password Manager Affected by Multiple Security Flaws, Researcher Reveals

Password management service LastPass is no stranger to vulnerabilities, from an autofill vulnerability just earlier this year to a major breach back in 2015 and numerous flaws reported in the interim. Now, Google Project Zero researcher Tavis Ormandy has reported three separate vulnerabilities in the service, one of which LastPass claims to have resolved.

The resolved vulnerability could have allowed attackers to perform remote code executions (if using the binary component), apart from stealing passwords, and affected Chrome and Firefox users utilising LastPass v4.1.42. LastPass claims this has been resolved, and Ormandy himself has marked the issue as fixed on the Project Zero site.

Update: LastPass says it has resolved the vulnerabilities pointed out by Tavis Ormandy. It claims users will not need to change their master password or any site credential passwords, but users must ensure they are running the latest versions of the LastPass - found on its download page. It also claims the v4.1.42 and v4.1.35 vulnerabilities were caused by the same issue, which has been resolved. Ormandy in a tweet commended the LastPass team for the speed of the resolutions.

As for the other two vulnerabilities, one affects an old LastPass add-on (v3.3.2) on Firefox that LastPass earlier this month said it is considering retiring, though after the vulnerability was reported by Ormandy it said it is working on a resolution. Ormandy refers to it as a quick exploit, implying it was easy to find and use.

The last LastPass vulnerability uncovered by Ormandy appears to be referring to an Internet Explorer add-on (v4.1.35) as Engadget points out. LastPass is yet to respond to this report by Ormandy.

With these many vulnerabilities reported in under a week, it’s quite apparent LastPass is on high alert, and could do with an extensive audit of its services. As we mentioned, this certainly isn’t the first time the password management service has been under fire, and Ormandy himself uncovered a major flaw last year.

Security is certainly not easy, but when you are responsible for managing the passwords for millions of users, staying on top of your game is paramount. Ormandy advises using KeePass or KeePassX password managers. Password management services built into browsers like Chrome, Firefox, Safari, and Opera are themselves not immune, so unless you start to follow security best practices to create and remember passwords, staying safe could be difficult.

For the latest tech news and reviews, follow Gadgets 360 on X, Facebook, WhatsApp, Threads and Google News. For the latest videos on gadgets and tech, subscribe to our YouTube channel. If you want to know everything about top influencers, follow our in-house Who'sThat360 on Instagram and YouTube.

 
Show Full Article
Please wait...
Advertisement

Related Stories

Popular Mobile Brands
  1. Astronomers Discover 3I/ATLAS, Largest Interstellar Comet Yet Detected
  1. Astronomers Discover 3I/ATLAS, Largest Interstellar Comet Yet Detected
  2. NASA's New Horizons Proves Deep-Space Navigation via Stellar Parallax
  3. AI Designs Ocean Gliders Inspired by Sea Creatures to Boost Underwater Research Efficiency
  4. Narivetta OTT Release Date: When and Where to Watch Tovino Thomas Starrer Political Drama Online?
  5. Kaalidhar Laapata Now Available on Zee5: What You Need to Know About Abhishek Bachchan's Starrer Movie
  6. Sri Sri Sri RajaVaru Now Streaming on Amazon Prime Video: Everything You Need to Know
  7. Hubble Observations Give Forgotten Globular Cluster Its Moment to Shine
  8. Very Massive Stars Blow Away Outer Layers in Powerful Winds Before Black Hole Collapse
  9. Astronomers Capture First-Ever Image of a Dead Star That Exploded Twice in Rare Supernova Event
  10. Climate Satellite MethaneSAT Fails After Just One Year in Orbit
© Copyright Red Pixels Ventures Limited 2025. All rights reserved.
Trending Products »
Latest Tech News »