Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 =========================================================================== AUSCERT Security Bulletin ASB-2017.0155 Multiple vulnerabilities have been identified in Mozilla Firefox and Mozilla Firefox ESR 29 September 2017 =========================================================================== AusCERT Security Bulletin Summary --------------------------------- Product: Mozilla Firefox Mozilla Firefox ESR Operating System: UNIX variants (UNIX, Linux, OSX) Windows Impact/Access: Execute Arbitrary Code/Commands -- Remote with User Interaction Cross-site Scripting -- Remote with User Interaction Denial of Service -- Remote with User Interaction Provide Misleading Information -- Remote with User Interaction Access Confidential Data -- Remote with User Interaction Reduced Security -- Remote with User Interaction Resolution: Patch/Upgrade CVE Names: CVE-2017-7825 CVE-2017-7824 CVE-2017-7823 CVE-2017-7822 CVE-2017-7821 CVE-2017-7820 CVE-2017-7819 CVE-2017-7818 CVE-2017-7817 CVE-2017-7816 CVE-2017-7815 CVE-2017-7814 CVE-2017-7813 CVE-2017-7812 CVE-2017-7811 CVE-2017-7810 CVE-2017-7805 CVE-2017-7793 Member content until: Sunday, October 29 2017 OVERVIEW Multiple vulnerabilities have been identified in Mozilla Firefox prior to version 56 and Firefox ESR prior to version 52.4 [1,2] IMPACT Mozilla has provided the following details regarding the vulnerabilities: Vulnerablities affecting Firefox and Firefox ESR: "#CVE-2017-7793: Use-after-free with Fetch API REPORTER Abhishek Arya IMPACT HIGH Description A use-after-free vulnerability can occur in the Fetch API when the worker or the associated window are freed when still in use, resulting in a potentially exploitable crash. References Bug 1371889 #CVE-2017-7818: Use-after-free during ARIA array manipulation REPORTER Nils IMPACT HIGH Description A use-after-free vulnerability can occur when manipulating arrays of Accessible Rich Internet Applications (ARIA) elements within containers through the DOM. This results in a potentially exploitable crash. References Bug 1363723 #CVE-2017-7819: Use-after-free while resizing images in design mode REPORTER Nils IMPACT HIGH Description A use-after-free vulnerability can occur in design mode when image objects are resized if objects referenced during the resizing have been freed from memory. This results in a potentially exploitable crash. References Bug 1380292 #CVE-2017-7824: Buffer overflow when drawing and validating elements with ANGLE REPORTER Omair, Andre Weissflog IMPACT HIGH Description A buffer overflow occurs when drawing and validating elements with the ANGLE graphics library, used for WebGL content. This is due to an incorrect value being passed within the library during checks and results in a potentially exploitable crash. References Bug 1398381 #CVE-2017-7805: Use-after-free in TLS 1.2 generating handshake hashes REPORTER Martin Thomson IMPACT HIGH Description During TLS 1.2 exchanges, handshake hashes are generated which point to a message buffer. This saved data is used for later messages but in some cases, the handshake transcript can exceed the space available in the current buffer, causing the allocation of a new buffer. This leaves a pointer pointing to the old, freed buffer, resulting in a use-after-free when handshake hashes are then calculated afterwards. This can result in a potentially exploitable crash. References Bug 1377618 #CVE-2017-7814: Blob and data URLs bypass phishing and malware protection warnings REPORTER Francois Marier IMPACT MODERATE Description File downloads encoded with blob: and data: URL elements bypassed normal file download checks though the Phishing and Malware Protection feature and its block lists of suspicious sites and files. This would allow malicious sites to lure users into downloading executables that would otherwise be detected as suspicious. References Bug 1376036 #CVE-2017-7825: OS X fonts render some Tibetan and Arabic unicode characters as spaces REPORTER Khalil Zhani IMPACT MODERATE Description Several fonts on OS X display some Tibetan and Arabic characters as whitespace. When used in the addressbar as part of an IDN this can be used for domain name spoofing attacks. Note: This attack only affects OS X operating systems. Other operating systems are unaffected. References Bug 1393624 Bug 1390980 #CVE-2017-7823: CSP sandbox directive did not create a unique origin REPORTER Jun Kokatsu IMPACT MODERATE Description The content security policy (CSP) sandbox directive did not create a unique origin for the document, causing it to behave as if the allow-same-origin keyword were always specified. This could allow a Cross-Site Scripting (XSS) attack to be launched from unsafe content. References Bug 1396320 #CVE-2017-7810: Memory safety bugs fixed in Firefox 56 and Firefox ESR 52.4 REPORTER Mozilla developers and community IMPACT CRITICAL Description Mozilla developers and community members Christoph Diehl, Jan de Mooij, Jason Kratzer, Randell Jesup, Tom Ritter, Tyson Smith, and Sebastian Hengst reported memory safety bugs present in Firefox 55 and Firefox ESR 52.3. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. References Memory safety bugs fixed in Firefox 56 and Firefox ESR 52.4" [1,2] Vulnerabilities particular to Firefox: "#CVE-2017-7817: Firefox for Android address bar spoofing through fullscreen mode REPORTER Raphael Saniyazov IMPACT HIGH Description A spoofing vulnerability can occur when a page switches to fullscreen mode without user notification, allowing a fake address bar to be displayed. This allows an attacker to spoof which page is actually loaded and in use. Note: This attack only affects Firefox for Android. Other operating systems are not affected. References Bug 1356596 #CVE-2017-7812: Drag and drop of malicious page content to the tab bar can open locally stored files REPORTER Tooru Fujisawa IMPACT MODERATE Description If web content on a page is dragged onto portions of the browser UI, such as the tab bar, links can be opened that otherwise would not be allowed to open. This can allow malicious web content to open a locally stored file through file: URLs. References Bug 1379842 #CVE-2017-7813: Integer truncation in the JavaScript parser REPORTER Abhishek Arya IMPACT MODERATE Description Inside the JavaScript parser, a cast of an integer to a narrower type can result in data read from outside the buffer being parsed. This usually results in a non-exploitable crash, but can leak a limited amount of information from memory if it matches JavaScript identifier syntax. References Bug 1383951 #CVE-2017-7815: Spoofing attack with modal dialogs on non-e10s installations REPORTER Jose Maria Acuna IMPACT MODERATE Description On pages containing an iframe, the data: protocol can be used to create a modal dialog through Javascript that will have an arbitrary domains as the dialog's location, spoofing of the origin of the modal dialog from the user view. Note: This attack only affects installations with e10 multiprocess turned off. Installations with e10s turned on do not support the modal dialog functionality. References Bug 1368981 #CVE-2017-7816: WebExtensions can load about: URLs in extension UI REPORTER Kestrel IMPACT MODERATE Description WebExtensions could use popups and panels in the extension UI to load an about: privileged URL, violating security checks that disallow this behavior. References Bug 1380597 #CVE-2017-7821: WebExtensions can download and open non-executable files without user interaction REPORTER Abdulrahman Alqabandi IMPACT MODERATE Description A vulnerability where WebExtensions can download and attempt to open a file of some non-executable file types. This can be triggered without specific user interaction for the file download and open actions. This could be used to trigger known vulnerabilities in the programs that handle those document types. References Bug 1346515 #CVE-2017-7822: WebCrypto allows AES-GCM with 0-length IV REPORTER Thanh Bui IMPACT LOW Description The AES-GCM implementation in WebCrypto API accepts 0-length IV when it should require a length of 1 according to the NIST Special Publication 800-38D specification. This might allow for the authentication key to be determined in some instances. References Bug 1368859 #CVE-2017-7820: Xray wrapper bypass with new tab and web console REPORTER Oriol Brufau IMPACT LOW Description The instanceof operator can bypass the Xray wrapper mechanism. When called on web content from the browser itself or an extension the web content can provide its own result for that operator, possibly tricking the browser or extension into mishandling the element. References Bug 1378207 #CVE-2017-7811: Memory safety bugs fixed in Firefox 56 REPORTER Mozilla developers and community IMPACT CRITICAL Description Mozilla developers and community members Christian Holler, Jason Kratzer, Tobias Schneider, Tyson Smith, David Keeler, Nicolas B. Pierron, Mike Hommey, Ronald Crane, Tooru Fujisawa, and Philipp reported memory safety bugs present in Firefox 55. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. References Memory safety bugs fixed in Firefox 56" [1,2] MITIGATION Users are advised to the upgrade to the latest versions to address these issues. [1,2] REFERENCES [1] Mozilla Foundation Security Advisory 2017-21 https://www.mozilla.org/en-US/security/advisories/mfsa2017-21/ [2] Mozilla Foundation Security Advisory 2017-22 https://www.mozilla.org/en-US/security/advisories/mfsa2017-22/ AusCERT has made every effort to ensure that the information contained in this document is accurate. However, the decision to use the information described is the responsibility of each user or organisation. The decision to follow or act on information or advice contained in this security bulletin is the responsibility of each user or organisation, and should be considered in accordance with your organisation's site policies and procedures. AusCERT takes no responsibility for consequences which may arise from following or acting on information or advice contained in this security bulletin. =========================================================================== Australian Computer Emergency Response Team The University of Queensland Brisbane Qld 4072 Internet Email: auscert@auscert.org.au Facsimile: (07) 3365 7031 Telephone: (07) 3365 4417 (International: +61 7 3365 4417) AusCERT personnel answer during Queensland business hours which are GMT+10:00 (AEST). On call after hours for member emergencies only. =========================================================================== -----BEGIN PGP SIGNATURE----- Comment: http://www.auscert.org.au/render.html?it=1967 iQIVAwUBWc2EOox+lLeg9Ub1AQgpwBAAjsQ27JJgDxR7BZLcLqbU3wRRuJsXkEsX 6XL51yrbC7rHI25dXDDcab2X+GtVCLIlI59LePkXAx7plh/4URz3mCvxpxQN4En4 NjzkbTV3f8niha5IxhtdamSWBYAv+xA0eUcTE/kovSTK52S1U9HufWlRLDdigtV3 4oRw2lc2xtf83QkRGpkXRUM+j09r/M64SOu8WmnrPupAIT/wTVFHkJkb3mmw5MXa 3kB2EWl0pwsZiU/Xsf2udJyiGm6XNW9GXF2fW6ugRWIgC2mII4Ku2fcOpUafD0TC KUNSDb0vEZtaTJpUpzCr5pQDyatmtRrABEfXwCd5195DAHq/F/VHuIjXfBGUQ0b5 QmjrGqKwnLy2BgPPRynwaqwhVBDLqoj+MCYPRSWb2QLeFxsV8bdufRhn9LciZolq mn6drgwXOLXk9QOywoeJm4eZcxcssR2frDWdSNWRWHPCw0c1PiZyyr5+XeE/o2x2 +Gv6G94sQt1q7sc8JVYv9lb04CFYttP5Mhya1e/WXgF9Lqg9a3pzz6i13M3LuKRx 0B4M6gsXLKrhCA1qj4alanKY/x/TmiRKEtkzCngbOqYPFCUT111srIAlE5h5CBPR YwbtPC7+wI3topYtB3FLdrRxvngjkp9W3Py7mUS5kBZnljbhPqMrCAOq4lhSddNd EXuCc8BiXKE= =uS2A -----END PGP SIGNATURE-----