The remote host is affected by the vulnerability described in GLSA-201605-06 (Mozilla Products: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Firefox, NSS, NSPR, and       Thunderbird. Please review the CVE identifiers referenced below for       details.
  Impact :

    A remote attacker could entice a user to view a specially crafted web       page or email, possibly resulting in execution of arbitrary code or a       Denial of Service condition. Furthermore, a remote attacker may be able       to perform Man-in-the-Middle attacks, obtain sensitive information, spoof       the address bar, conduct clickjacking attacks, bypass security       restrictions and protection mechanisms, or have other unspecified       impacts.
  Workaround :

    There is no known workaround at this time.

The remote Ubuntu 14.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-2893-1 advisory.

    Jason Pang discovered that service workers intercept responses to plugin network requests made through the     browser. An attacker could potentially exploit this to bypass same origin restrictions using the Flash     plugin. (CVE-2016-1949)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Mozilla Firefox installed on the remote Mac OS X host is prior to 44.0.2. It is, therefore, affected by a security bypass vulnerability due to improper restriction of interaction between service workers and plugins. An unauthenticated, remote attacker can exploit this, via a crafted web site that triggers spoofed responses to requests that use NPAPI, to bypass the same-origin policy.

The version of Mozilla Firefox installed on the remote Windows host is prior to 44.0.2. It is, therefore, affected by a security bypass vulnerability due to improper restriction of interaction between service workers and plugins. An unauthenticated, remote attacker can exploit this, via a crafted web site that triggers spoofed responses to requests that use NPAPI, to bypass the same-origin policy.

This update for MozillaFirefox fixes the following issues :

  - update to Firefox 44.0.2

  - MFSA 2016-13/CVE-2016-1949 (bmo#1245724, boo#966438)     Same-origin-policy violation using Service Workers with     plugins

  - Fix issue which could lead to the removal of stored     passwords under certain circumstances (bmo#1242176)

  - Allows spaces in cookie names (bmo#1244505)

  - Disable opus/vorbis audio with H.264 (bmo#1245696)

  - Fix for graphics startup crash (GNU/Linux) (bmo#1222171)

  - Fix a crash in cache networking (bmo#1244076)

  - Fix using WebSockets in service worker controlled pages     (bmo#1243942)

The Mozilla Foundation reports :

MFSA 2016-13 Jason Pang of OneSignal reported that service workers intercept responses to plugin network requests made through the browser. Plugins which make security decisions based on the content of network requests can have these decisions subverted if a service worker forges responses to those requests. For example, a forged crossdomain.xml could allow a malicious site to violate the same-origin policy using the Flash plugin.

The version of Firefox installed is prior to 44.0.2 and is affected by a security bypass vulnerability due to improper restriction of interaction between service workers and plugins. An unauthenticated, remote attacker can exploit this using a crafted web site that triggers spoofed responses to requests that use NPAPI to bypass the same-origin policy. (CVE-2016-1949)

ID	Name	Product	Family	Published	Updated	Severity
91379	GLSA-201605-06 : Mozilla Products: Multiple vulnerabilities (Logjam) (SLOTH)	Nessus	Gentoo Local Security Checks	5/31/2016	12/5/2022	critical
88711	Ubuntu 14.04 LTS : Firefox vulnerability (USN-2893-1)	Nessus	Ubuntu Local Security Checks	2/12/2016	8/27/2024	high
88752	Firefox < 44.0.2 Service Workers Security Bypass (Mac OS X)	Nessus	MacOS X Local Security Checks	2/16/2016	11/20/2019	high
88754	Firefox < 44.0.2 Service Workers Security Bypass	Nessus	Windows	2/16/2016	11/20/2019	high
88828	openSUSE Security Update : MozillaFirefox (openSUSE-2016-223)	Nessus	SuSE Local Security Checks	2/18/2016	1/19/2021	high
88743	FreeBSD : firefox -- Same-origin-policy violation using Service Workers with plugins (172b22cb-d3f6-11e5-ac9e-485d605f4717)	Nessus	FreeBSD Local Security Checks	2/16/2016	1/4/2021	high
88946	openSUSE Security Update : Mozilla Firefox (openSUSE-2016-259)	Nessus	SuSE Local Security Checks	2/25/2016	1/19/2021	high
9077	Mozilla Firefox < 44.0.2 Security Bypass Vulnerability	Nessus Network Monitor	Web Clients	2/19/2016	3/6/2019	low

Detections

Analytics

Plugins Search

critical

high

high

high

high

high

high

low