254106 - Launching Mozilla using RunAs Service causes mozilla to load wrong user profile

Status: RESOLVED DUPLICATE of bug 245583

(Core Graveyard :: Profile: BackEnd, defect)

Description

[Badriram Rajagopalan]

User-Agent:       Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 1.1.4322)
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8a3) Gecko/20040802

Launching Mozilla (and latest build of firefox) using RunAs Service causes it 
load the user profile of the persons desktop that is loaded and not the RunAs 
user. This causes stored passwords and other personal information available to 
the account logged in under Runas. It also allows the passwords to be saved 
back to the Desktop_user's profile. 

For instance, Regular_user logs into desktop, Admin uses Runas service to 
launch browser, saves password on some website. Admin closes browser, 
Regular_user launches browser can use the saved passwords etc.

Reproducible: Always
Steps to Reproduce:
1. Login with user Account1.
2. RunAs Mozilla with user Account2
3. Save a password
4. Close browser
5. Open browser with user Account1
6. Viola, got access to site with authentication

Actual Results:  
Can open sites with other users authentication, 

Expected Results:  
Should load the right users profile while using RunAs.

Comment 1

[Daniel Veditz [:dveditz]]

Reassigning over to the profile folks, but it's probably the directory service
(XPCOM) getting this wrong. But I'm reasonably sure we get this value from the
windows shell service, is this maybe a windows bug?

WFM with 1.7 and aviary branch builds, haven't tried a trunk build as reported
against. Any profile changes on the trunk?

Comment 2

[Daniel Veditz [:dveditz]]

Clearing the security flag: this is not remotely exploitable, and if in fact
this is confirmed it would be better for people to know they are potentially at
risk of giving away passwords and cookies with RunAs.

Comment 3

[Badriram Rajagopalan]

(In reply to comment #2)
> Clearing the security flag: this is not remotely exploitable, and if in fact
> this is confirmed it would be better for people to know they are potentially at
> risk of giving away passwords and cookies with RunAs.

Yup while browsing through other new bugs, I noticed a similar one 245583. So we
can mark it as a duplicate.... 

PS: Sorry i did search and did not find that bug when i submitted this one.

Comment 4

[Daniel Veditz [:dveditz]]

*** This bug has been marked as a duplicate of 245583 ***