Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT Security Bulletin
ASB-2017.0155
Multiple vulnerabilities have been identified in Mozilla
Firefox and Mozilla Firefox ESR
29 September 2017
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: Mozilla Firefox
Mozilla Firefox ESR
Operating System: UNIX variants (UNIX, Linux, OSX)
Windows
Impact/Access: Execute Arbitrary Code/Commands -- Remote with User Interaction
Cross-site Scripting -- Remote with User Interaction
Denial of Service -- Remote with User Interaction
Provide Misleading Information -- Remote with User Interaction
Access Confidential Data -- Remote with User Interaction
Reduced Security -- Remote with User Interaction
Resolution: Patch/Upgrade
CVE Names: CVE-2017-7825 CVE-2017-7824 CVE-2017-7823
CVE-2017-7822 CVE-2017-7821 CVE-2017-7820
CVE-2017-7819 CVE-2017-7818 CVE-2017-7817
CVE-2017-7816 CVE-2017-7815 CVE-2017-7814
CVE-2017-7813 CVE-2017-7812 CVE-2017-7811
CVE-2017-7810 CVE-2017-7805 CVE-2017-7793
Member content until: Sunday, October 29 2017
OVERVIEW
Multiple vulnerabilities have been identified in Mozilla Firefox
prior to version 56 and Firefox ESR prior to version 52.4 [1,2]
IMPACT
Mozilla has provided the following details regarding the
vulnerabilities:
Vulnerablities affecting Firefox and Firefox ESR:
"#CVE-2017-7793: Use-after-free with Fetch API
REPORTER Abhishek Arya IMPACT HIGH Description
A use-after-free vulnerability can occur in the Fetch API when the
worker or the associated window are freed when still in use,
resulting in a potentially exploitable crash.
References
Bug 1371889
#CVE-2017-7818: Use-after-free during ARIA array manipulation
REPORTER Nils IMPACT HIGH Description
A use-after-free vulnerability can occur when manipulating arrays of
Accessible Rich Internet Applications (ARIA) elements within
containers through the DOM. This results in a potentially
exploitable crash.
References
Bug 1363723
#CVE-2017-7819: Use-after-free while resizing images in design mode
REPORTER Nils IMPACT HIGH Description
A use-after-free vulnerability can occur in design mode when image
objects are resized if objects referenced during the resizing have
been freed from memory. This results in a potentially exploitable
crash.
References
Bug 1380292
#CVE-2017-7824: Buffer overflow when drawing and validating elements
with ANGLE
REPORTER Omair, Andre Weissflog IMPACT HIGH Description
A buffer overflow occurs when drawing and validating elements with
the ANGLE graphics library, used for WebGL content. This is due to
an incorrect value being passed within the library during checks and
results in a potentially exploitable crash.
References
Bug 1398381
#CVE-2017-7805: Use-after-free in TLS 1.2 generating handshake
hashes
REPORTER Martin Thomson IMPACT HIGH Description
During TLS 1.2 exchanges, handshake hashes are generated which point
to a message buffer. This saved data is used for later messages but
in some cases, the handshake transcript can exceed the space
available in the current buffer, causing the allocation of a new
buffer. This leaves a pointer pointing to the old, freed buffer,
resulting in a use-after-free when handshake hashes are then
calculated afterwards. This can result in a potentially exploitable
crash.
References
Bug 1377618
#CVE-2017-7814: Blob and data URLs bypass phishing and malware
protection warnings
REPORTER Francois Marier IMPACT MODERATE Description
File downloads encoded with blob: and data: URL elements bypassed
normal file download checks though the Phishing and Malware
Protection feature and its block lists of suspicious sites and
files. This would allow malicious sites to lure users into
downloading executables that would otherwise be detected as
suspicious.
References
Bug 1376036
#CVE-2017-7825: OS X fonts render some Tibetan and Arabic unicode
characters as spaces
REPORTER Khalil Zhani IMPACT MODERATE Description
Several fonts on OS X display some Tibetan and Arabic characters as
whitespace. When used in the addressbar as part of an IDN this can
be used for domain name spoofing attacks. Note: This attack only
affects OS X operating systems. Other operating systems are
unaffected.
References
Bug 1393624 Bug 1390980
#CVE-2017-7823: CSP sandbox directive did not create a unique origin
REPORTER Jun Kokatsu IMPACT MODERATE Description
The content security policy (CSP) sandbox directive did not create a
unique origin for the document, causing it to behave as if the
allow-same-origin keyword were always specified. This could allow a
Cross-Site Scripting (XSS) attack to be launched from unsafe
content.
References
Bug 1396320
#CVE-2017-7810: Memory safety bugs fixed in Firefox 56 and Firefox
ESR 52.4
REPORTER Mozilla developers and community IMPACT CRITICAL
Description
Mozilla developers and community members Christoph Diehl, Jan de
Mooij, Jason Kratzer, Randell Jesup, Tom Ritter, Tyson Smith, and
Sebastian Hengst reported memory safety bugs present in Firefox 55
and Firefox ESR 52.3. Some of these bugs showed evidence of memory
corruption and we presume that with enough effort that some of these
could be exploited to run arbitrary code.
References
Memory safety bugs fixed in Firefox 56 and Firefox ESR 52.4" [1,2]
Vulnerabilities particular to Firefox:
"#CVE-2017-7817: Firefox for Android address bar spoofing through
fullscreen mode
REPORTER Raphael Saniyazov IMPACT HIGH Description
A spoofing vulnerability can occur when a page switches to
fullscreen mode without user notification, allowing a fake address
bar to be displayed. This allows an attacker to spoof which page is
actually loaded and in use. Note: This attack only affects Firefox
for Android. Other operating systems are not affected.
References
Bug 1356596
#CVE-2017-7812: Drag and drop of malicious page content to the tab
bar can open locally stored files
REPORTER Tooru Fujisawa IMPACT MODERATE Description
If web content on a page is dragged onto portions of the browser UI,
such as the tab bar, links can be opened that otherwise would not be
allowed to open. This can allow malicious web content to open a
locally stored file through file: URLs.
References
Bug 1379842
#CVE-2017-7813: Integer truncation in the JavaScript parser
REPORTER Abhishek Arya IMPACT MODERATE Description
Inside the JavaScript parser, a cast of an integer to a narrower
type can result in data read from outside the buffer being parsed.
This usually results in a non-exploitable crash, but can leak a
limited amount of information from memory if it matches JavaScript
identifier syntax.
References
Bug 1383951
#CVE-2017-7815: Spoofing attack with modal dialogs on non-e10s
installations
REPORTER Jose Maria Acuna IMPACT MODERATE Description
On pages containing an iframe, the data: protocol can be used to
create a modal dialog through Javascript that will have an arbitrary
domains as the dialog's location, spoofing of the origin of the
modal dialog from the user view. Note: This attack only affects
installations with e10 multiprocess turned off. Installations with
e10s turned on do not support the modal dialog functionality.
References
Bug 1368981
#CVE-2017-7816: WebExtensions can load about: URLs in extension UI
REPORTER Kestrel IMPACT MODERATE Description
WebExtensions could use popups and panels in the extension UI to
load an about: privileged URL, violating security checks that
disallow this behavior.
References
Bug 1380597
#CVE-2017-7821: WebExtensions can download and open non-executable
files without user interaction
REPORTER Abdulrahman Alqabandi IMPACT MODERATE Description
A vulnerability where WebExtensions can download and attempt to open
a file of some non-executable file types. This can be triggered
without specific user interaction for the file download and open
actions. This could be used to trigger known vulnerabilities in the
programs that handle those document types.
References
Bug 1346515
#CVE-2017-7822: WebCrypto allows AES-GCM with 0-length IV
REPORTER Thanh Bui IMPACT LOW Description
The AES-GCM implementation in WebCrypto API accepts 0-length IV when
it should require a length of 1 according to the NIST Special
Publication 800-38D specification. This might allow for the
authentication key to be determined in some instances.
References
Bug 1368859
#CVE-2017-7820: Xray wrapper bypass with new tab and web console
REPORTER Oriol Brufau IMPACT LOW Description
The instanceof operator can bypass the Xray wrapper mechanism. When
called on web content from the browser itself or an extension the
web content can provide its own result for that operator, possibly
tricking the browser or extension into mishandling the element.
References
Bug 1378207
#CVE-2017-7811: Memory safety bugs fixed in Firefox 56
REPORTER Mozilla developers and community IMPACT CRITICAL
Description
Mozilla developers and community members Christian Holler, Jason
Kratzer, Tobias Schneider, Tyson Smith, David Keeler, Nicolas B.
Pierron, Mike Hommey, Ronald Crane, Tooru Fujisawa, and Philipp
reported memory safety bugs present in Firefox 55. Some of these
bugs showed evidence of memory corruption and we presume that with
enough effort that some of these could be exploited to run arbitrary
code.
References
Memory safety bugs fixed in Firefox 56" [1,2]
MITIGATION
Users are advised to the upgrade to the latest versions to address these issues. [1,2]
REFERENCES
[1] Mozilla Foundation Security Advisory 2017-21
https://www.mozilla.org/en-US/security/advisories/mfsa2017-21/
[2] Mozilla Foundation Security Advisory 2017-22
https://www.mozilla.org/en-US/security/advisories/mfsa2017-22/
AusCERT has made every effort to ensure that the information contained
in this document is accurate. However, the decision to use the information
described is the responsibility of each user or organisation. The decision to
follow or act on information or advice contained in this security bulletin is
the responsibility of each user or organisation, and should be considered in
accordance with your organisation's site policies and procedures. AusCERT
takes no responsibility for consequences which may arise from following or
acting on information or advice contained in this security bulletin.
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBWc2EOox+lLeg9Ub1AQgpwBAAjsQ27JJgDxR7BZLcLqbU3wRRuJsXkEsX
6XL51yrbC7rHI25dXDDcab2X+GtVCLIlI59LePkXAx7plh/4URz3mCvxpxQN4En4
NjzkbTV3f8niha5IxhtdamSWBYAv+xA0eUcTE/kovSTK52S1U9HufWlRLDdigtV3
4oRw2lc2xtf83QkRGpkXRUM+j09r/M64SOu8WmnrPupAIT/wTVFHkJkb3mmw5MXa
3kB2EWl0pwsZiU/Xsf2udJyiGm6XNW9GXF2fW6ugRWIgC2mII4Ku2fcOpUafD0TC
KUNSDb0vEZtaTJpUpzCr5pQDyatmtRrABEfXwCd5195DAHq/F/VHuIjXfBGUQ0b5
QmjrGqKwnLy2BgPPRynwaqwhVBDLqoj+MCYPRSWb2QLeFxsV8bdufRhn9LciZolq
mn6drgwXOLXk9QOywoeJm4eZcxcssR2frDWdSNWRWHPCw0c1PiZyyr5+XeE/o2x2
+Gv6G94sQt1q7sc8JVYv9lb04CFYttP5Mhya1e/WXgF9Lqg9a3pzz6i13M3LuKRx
0B4M6gsXLKrhCA1qj4alanKY/x/TmiRKEtkzCngbOqYPFCUT111srIAlE5h5CBPR
YwbtPC7+wI3topYtB3FLdrRxvngjkp9W3Py7mUS5kBZnljbhPqMrCAOq4lhSddNd
EXuCc8BiXKE=
=uS2A
-----END PGP SIGNATURE-----