Mozilla Firefox up to 68.x History HSTS initialization

Summaryinfo

A vulnerability labeled as problematic has been found in Mozilla Firefox up to 68.x. This impacts an unknown function of the component History Handler. The manipulation results in initialization (HSTS). This vulnerability is cataloged as CVE-2019-11747. The attack may be launched remotely. There is no exploit available. The affected component should be upgraded.

Detailsinfo

A vulnerability was found in Mozilla Firefox up to 68.x (Web Browser). It has been classified as problematic. Affected is an unknown part of the component History Handler. The manipulation with an unknown input leads to a initialization vulnerability (HSTS). CWE is classifying the issue as CWE-665. The product does not initialize or incorrectly initializes a resource, which might leave the resource in an unexpected state when it is accessed or used. This is going to have an impact on confidentiality. CVE summarizes:

The "Forget about this site" feature in the History pane is intended to remove all saved user data that indicates a user has visited a site. This includes removing any HTTP Strict Transport Security (HSTS) settings received from sites that use it. Due to a bug, sites on the pre-load list also have their HSTS setting removed. On the next visit to that site if the user specifies an http: URL rather than secure https: they will not be protected by the pre-loaded HSTS setting. After that visit the site's HSTS setting will be restored. This vulnerability affects Firefox < 69 and Firefox ESR < 68.1.

The weakness was shared 09/27/2019 as MFSA 2019-25 as confirmed security advisory (Website). The advisory is shared for download at mozilla.org. This vulnerability is traded as CVE-2019-11747 since 05/03/2019. The exploitability is told to be difficult. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. Successful exploitation requires user interaction by the victim. There are neither technical details nor an exploit publicly available.

The vulnerability scanner Nessus provides a plugin with the ID 246668 (Linux Distros Unpatched Vulnerability : CVE-2019-11747), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 69.0 eliminates this vulnerability. A possible mitigation has been published immediately after the disclosure of the vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (246668). The entries VDB-142392, VDB-142393, VDB-142394 and VDB-142395 are related to this item. Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Web Browser

Vendor

• Mozilla

Name

• Firefox

Version

• 68.x

License

• open-source

Website

• Vendor: https://www.mozilla.org/
• Product: https://www.mozilla.org/en-US/firefox/

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion