nspluginwrapper before 1.4.4 does not properly provide access to NPNVprivateModeBool variable settings, which could prevent Firefox plugins from determining if they should run in Private Browsing mode and allow remote attackers to bypass intended access restrictions, as demonstrated using Flash.

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched.

  - nspluginwrapper: NPNVprivateModeBool variable not forwarded (CVE-2011-2486)

Note that Nessus has not tested for this issue but has instead relied on the package manager's report that the package is installed.

The remote Oracle Linux 6 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2012-1459 advisory.

    [1.4.4-1]
    - Rebase the package to latest upstream
    - Added Adobe reader fix (#645599)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It was not possible for plug-ins wrapped by nspluginwrapper to discover whether the browser was running in Private Browsing mode.
This flaw could lead to plug-ins wrapped by nspluginwrapper using normal mode while they were expected to run in Private Browsing mode.
(CVE-2011-2486)

This update also fixes the following bug :

  - When using the Adobe Reader(tm) web browser plug-in     provided by the acroread-plugin package on a 64-bit     system, opening Portable Document Format (PDF) files in     Firefox could cause the plug-in to crash and a black     window to be displayed where the PDF should be. Firefox     had to be restarted to resolve the issue. This update     implements a workaround in nspluginwrapper to     automatically handle the plug-in crash, so that users no     longer have to keep restarting Firefox.

This will update nspluginwrapper to upstream version 1.4.4.

After installing the update, Firefox must be restarted for the changes to take effect.

The remote Redhat Enterprise Linux 6 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2012:1459 advisory.

  - nspluginwrapper: NPNVprivateModeBool variable not forwarded (CVE-2011-2486)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Updated nspluginwrapper packages that fix one security issue and one bug are now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having low security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

nspluginwrapper is a utility which allows 32-bit plug-ins to run in a 64-bit browser environment (a common example is Adobe's browser plug-in for presenting proprietary Flash files embedded in web pages).
It includes the plug-in viewer and a tool for managing plug-in installations and updates.

It was not possible for plug-ins wrapped by nspluginwrapper to discover whether the browser was running in Private Browsing mode.
This flaw could lead to plug-ins wrapped by nspluginwrapper using normal mode while they were expected to run in Private Browsing mode.
(CVE-2011-2486)

This update also fixes the following bug :

* When using the Adobe Reader web browser plug-in provided by the acroread-plugin package on a 64-bit system, opening Portable Document Format (PDF) files in Firefox could cause the plug-in to crash and a black window to be displayed where the PDF should be. Firefox had to be restarted to resolve the issue. This update implements a workaround in nspluginwrapper to automatically handle the plug-in crash, so that users no longer have to keep restarting Firefox. (BZ#869554)

All users of nspluginwrapper are advised to upgrade to these updated packages, which upgrade nspluginwrapper to upstream version 1.4.4, and correct these issues. After installing the update, Firefox must be restarted for the changes to take effect.

ID	Name	Product	Family	Severity
198688	RHEL 5 : nspluginwrapper (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
68656	Oracle Linux 6 : nspluginwrapper (ELSA-2012-1459)	Nessus	Oracle Linux Local Security Checks	critical
62919	Scientific Linux Security Update : nspluginwrapper on SL6.x i386/x86_64 (20121113)	Nessus	Scientific Linux Local Security Checks	medium
62917	RHEL 6 : nspluginwrapper (RHSA-2012:1459)	Nessus	Red Hat Local Security Checks	critical
62911	CentOS 6 : nspluginwrapper (CESA-2012:1459)	Nessus	CentOS Local Security Checks	medium

Detections

Analytics

CVE-2011-2486

critical

Tenable Plugins

critical

critical

medium

critical

medium