Mozilla Firefox up to 77.x on Windows webauthn.dll uncontrolled search path

Summaryinfo

A vulnerability marked as critical has been reported in Mozilla Firefox up to 77.x on Windows. Affected is an unknown function in the library webauthn.dll. The manipulation leads to uncontrolled search path. This vulnerability is referenced as CVE-2020-12423. The attack can only be performed from a local environment. No exploit is available. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability was found in Mozilla Firefox up to 77.x on Windows (Web Browser). It has been rated as critical. This issue affects an unknown code in the library webauthn.dll. The manipulation with an unknown input leads to a uncontrolled search path vulnerability. Using CWE to declare the problem leads to CWE-427. The product uses a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of unintended actors. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

When the Windows DLL "webauthn.dll" was missing from the Operating System, and a malicious one was placed in a folder in the user's %PATH%, Firefox may have loaded the DLL, leading to arbitrary code execution. *Note: This issue only affects the Windows operating system; other operating systems are unaffected.* This vulnerability affects Firefox < 78.

The weakness was published 07/09/2020 as Bug 1642400 as not defined bug report (Bugzilla). The advisory is shared at bugzilla.mozilla.org. The identification of this vulnerability is CVE-2020-12423 since 04/28/2020. An attack has to be approached locally. No form of authentication is needed for a successful exploitation. It demands that the victim is doing some kind of user interaction. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1574 for this issue.

Upgrading to version 78.0 eliminates this vulnerability.

Similar entries are available at VDB-157808, VDB-157807, VDB-157806 and VDB-157804. If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Web Browser

Vendor

• Mozilla

Name

• Firefox

Version

• 77.x

License

• open-source

Website

• Vendor: https://www.mozilla.org/
• Product: https://www.mozilla.org/en-US/firefox/

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion