Mozilla Firefox up to 68.x Maintenance Service Update integrity check

Summaryinfo

A vulnerability, which was classified as critical, was found in Mozilla Firefox up to 68.x. This issue affects some unknown processing of the component Maintenance Service. The manipulation as part of Update results in integrity check. This vulnerability is known as CVE-2019-11753. Attacking locally is a requirement. No exploit is available. You should upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as critical, was found in Mozilla Firefox up to 68.x (Web Browser). Affected is some unknown functionality of the component Maintenance Service. The manipulation as part of a Update leads to a integrity check vulnerability. CWE is classifying the issue as CWE-354. The product does not validate or incorrectly validates the integrity check values or "checksums" of a message. This may prevent it from detecting if the data has been modified or corrupted in transmission. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

The Firefox installer allows Firefox to be installed to a custom user writable location, leaving it unprotected from manipulation by unprivileged users or malware. If the Mozilla Maintenance Service is manipulated to update this unprotected location and the updated maintenance service in the unprotected location has been altered, the altered maintenance service can run with elevated privileges during the update process due to a lack of integrity checks. This allows for privilege escalation if the executable has been replaced locally. <br>*Note: This attack requires local system access and only affects Windows. Other operating systems are not affected.*. This vulnerability affects Firefox < 69, Firefox ESR < 60.9, and Firefox ESR < 68.1.

The weakness was published 09/27/2019 as MFSA 2019-25 as confirmed security advisory (Website). The advisory is available at mozilla.org. This vulnerability is traded as CVE-2019-11753 since 05/03/2019. The exploitability is told to be easy. Local access is required to approach this attack. The exploitation doesn't require any form of authentication. The technical details are unknown and an exploit is not available.

Upgrading to version 69.0 eliminates this vulnerability. A possible mitigation has been published immediately after the disclosure of the vulnerability.

Similar entries are available at VDB-142392, VDB-142393, VDB-142394 and VDB-142395. If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• Web Browser

Vendor

• Mozilla

Name

• Firefox

Version

• 68.x

License

• open-source

Website

• Vendor: https://www.mozilla.org/
• Product: https://www.mozilla.org/en-US/firefox/

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion