Mozilla Firefox for Android < 28.0.1 Multiple Vulnerabilities

medium Nessus Network Monitor Plugin ID 8175

Synopsis

The remote host has a web browser installed that is vulnerable to multiple attack vectors.

Description

Versions of Mozilla Firefox older than 28.0.1 are unpatched for the following two vulnerabilities:

- A local file disclosure vulnerability due to the way the 'file' protocol is handled. Of specific concern is that files in the Firefox profile directory can be copied to the SD card, which is world-readable, when hyperlinked using the 'file:' protocol, resulting in sensitive information disclosure. (CVE-2014-1515)

- The 'Math.random()' function used by 'saltProfileName' function is cryptographically weak; an attacker could leverage this to predict profile directory name to aid in further attacks in conjunction with other vulnerabilities. (CVE-2014-1516)

Solution

Upgrade to Mozilla Firefox 28.0.1 for Android (or later) from the Google Play app store.

Plugin Details

Severity: Medium

ID: 8175

Family: Web Clients

Published: 3/26/2014

Updated: 3/6/2019

Risk Information

VPR

Risk Factor: Low

Score: 3.5

CVSS v2

Risk Factor: Medium

Base Score: 5.8

Temporal Score: 5

Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:N/A:P

CVSS v3

Risk Factor: Medium

Base Score: 4.8

Temporal Score: 4.6

Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L

Temporal Vector: CVSS:3.0/E:X/RL:O/RC:C

Vulnerability Information

CPE: cpe:/a:mozilla:firefox_mobile

Patch Publication Date: 3/24/2014

Vulnerability Publication Date: 3/24/2014

Reference Information

CVE: CVE-2014-1515, CVE-2014-1516

BID: 66393, 66479

Detections

Analytics