Mozilla Firefox/Firefox ESR/Thunderbird STUN Server use after free

Summaryinfo

A vulnerability categorized as critical has been discovered in Mozilla Firefox, Firefox ESR and Thunderbird. The impacted element is an unknown function of the component STUN Server Handler. Such manipulation leads to use after free. This vulnerability is uniquely identified as CVE-2020-12420. The attack can be launched remotely. No exploit exists. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability was found in Mozilla Firefox, Firefox ESR and Thunderbird (Web Browser) (affected version unknown) and classified as critical. Affected by this issue is an unknown functionality of the component STUN Server Handler. The manipulation with an unknown input leads to a use after free vulnerability. Using CWE to declare the problem leads to CWE-416. Referencing memory after it has been freed can cause a program to crash, use unexpected values, or execute code. Impacted is confidentiality, integrity, and availability. CVE summarizes:

When trying to connect to a STUN server, a race condition could have caused a use-after-free of a pointer, leading to memory corruption and a potentially exploitable crash. This vulnerability affects Firefox ESR < 68.10, Firefox < 78, and Thunderbird < 68.10.0.

The weakness was disclosed 07/09/2020 as Bug 1643437 as not defined bug report (Bugzilla). The advisory is available at bugzilla.mozilla.org. This vulnerability is handled as CVE-2020-12420 since 04/28/2020. The attack may be launched remotely. No form of authentication is required for exploitation. Successful exploitation requires user interaction by the victim. The technical details are unknown and an exploit is not available. The structure of the vulnerability defines a possible price range of USD $0-$5k at the moment (estimation calculated on 10/14/2024).

The vulnerability scanner Nessus provides a plugin with the ID 208600 (CentOS 7 : thunderbird (RHSA-2020:2906)), which helps to determine the existence of the flaw in a target environment.

Upgrading eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (208600). The entries VDB-157803, VDB-157801, VDB-157800 and VDB-157799 are pretty similar. If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• Web Browser

Vendor

• Mozilla

Name

• Firefox
• Firefox ESR
• Thunderbird

License

• open-source

Website

• Vendor: https://www.mozilla.org/
• Product: https://www.mozilla.org/en-US/firefox/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion