Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
===========================================================================
AUSCERT Security Bulletin
ASB-2015.0030
Mozilla Firefox version 37.0.1 has been released to correct
multiple vulnerabilities.
8 April 2015
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: Mozilla Firefox
Operating System: UNIX variants (UNIX, Linux, OSX)
Windows
Android
Impact/Access: Access Privileged Data -- Remote with User Interaction
Provide Misleading Information -- Remote with User Interaction
Reduced Security -- Remote with User Interaction
Resolution: Patch/Upgrade
CVE Names: CVE-2015-0799 CVE-2015-0798
Member content until: Friday, May 8 2015
OVERVIEW
Mozilla Firefox version 37.0.1 has been released to correct multiple
vulnerabilities. [1 - 3]
IMPACT
The vendor has provided the following details regarding these
issues:
CVE-2015-0798: "Security researcher Armin Razmdjou reported a flaw
in Reader mode on Firefox for Android. Reader mode reformats web
content for easy readability and operates as unprivileged content
that is the equivalent of the formatted content. When Reader mode is
unable to process content, it displays the original web pages. Since
it is unprivileged, there are no restrictions on pages linking to or
framing Reader mode content. The reported flaw is that privileged
URLs can be passed to Reader mode and bypass the normal restrictions
that prevent web pages from obtaining references to privileged
contexts. If this issue was combined with another flaw that allowed
for a violation of the same-origin policy, then the resulting
combination could lead to arbitrary code execution.
This flaw only affects Firefox for Android and pre-release versions
of Desktop Firefox. The released version of desktop Firefox does not
have reader mode and is not affected." [2]
CVE-2015-0799:"Security researcher Muneaki Nishimura discovered a
flaw in the Mozilla's HTTP Alternative Services implementation. If
an Alt-Svc header is specified in the HTTP/2 response, SSL
certificate verification can be bypassed for the specified alternate
server. As a result of this, warnings of invalid SSL certificates
will not be displayed and an attacker could potentially impersonate
another site through a man-in-the-middle (MTIM), replacing the
original certificate with their own." [3]
MITIGATION
The vendor recommends updating to the latest versions of Mozilla
Firefox. [1 - 3]
REFERENCES
[1] Mozilla Foundation Security Advisories
https://www.mozilla.org/en-US/security/advisories/
[2] Loading privileged content through Reader mode
https://www.mozilla.org/en-US/security/advisories/mfsa2015-43/
[3] Certificate verification bypass through the HTTP/2 Alt-Svc header
https://www.mozilla.org/en-US/security/advisories/mfsa2015-44/
AusCERT has made every effort to ensure that the information contained
in this document is accurate. However, the decision to use the information
described is the responsibility of each user or organisation. The decision to
follow or act on information or advice contained in this security bulletin is
the responsibility of each user or organisation, and should be considered in
accordance with your organisation's site policies and procedures. AusCERT
takes no responsibility for consequences which may arise from following or
acting on information or advice contained in this security bulletin.
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBVSSphRLndAQH1ShLAQJtnw//ZFnCp3JCoBfYdmKbzUW1c+1YXTJLg0Ma
h+cTYM/mr0xrKh6b21Dj0w9XkUPw0/7SCn3e9q5uNGYed2R54SiJr2DMvuP8GQ0l
QPBxA8DijSGkAu1Y5DBLNjNRtg8CQS9bvn84GL7FrWtSlKz1SYE1ieQeTEBAcV+p
KfDNDFqn7X77sTAUUD4547twFJ+Wz/ZAlb0SZOI4R/v4iGQW5WyqDxNeD5bxKthH
plIy5mUBgUxrD5A13sA0vhhTipnk0DmkzIlinqNL/GR7zi+9B9RuYaeLERQuQF+v
KrXk+XgmP5js8ECBIfp0xW3Ph1fmNufgqxIdFUKqBivMBzugAYmcypFKF+8TS2Ob
XW8nViVewPIY7ignQZt/xaYJ9bkUNeyN+S9pVUUJJCyR1uXC8MzW8H4/cRxUjknr
nKjSvkvurH838E9ABMchW91sFq0sMzBcU2umYLo9iJQB0CucCplhW4WV7oeb90n7
uxJBD2KBWI8uelfli8PL8icbYpQyLaGZc7seSng2+Ea42UpFju+g2BO7+Qv+eC4o
sdtEg7xa7OtG/mqsNX6ExmXuome2UPLNq2YosFGzq4WWUhUgbic1bkwMefj9ze1k
tZ6nnortcxHWMNG1REhdhTu7sZzRp2kNngMU6AAUvztkY+wYZzO7ML5fO+kRnx8y
jzVqJWCayBQ=
=3E3N
-----END PGP SIGNATURE-----