Уязвимость некорректной проверки идентификатора дополнения при обновлении в Mozilla Firefox
Описание
В обновлениях дополнений не проводится корректная проверка, что идентификатор дополнения внутри подписанного пакета совпадает с идентификатором обновляемого дополнения. Злоумышленник, способный осуществить атаку "человек посередине" (man-in-the-middle) на соединение пользователя с сервером обновлений и обойти защиту привязки сертификатов, может предоставить вредоносное подписанное дополнение вместо корректного обновления.
Затронутые версии ПО
- Firefox ESR < 45.5
- Firefox < 50
Тип уязвимости
Подмена дополнения
Ссылки
- Third Party Advisory
- Third Party AdvisoryVDB Entry
- Third Party AdvisoryVDB Entry
- Issue TrackingPatch
- Third Party Advisory
- Vendor Advisory
- Vendor Advisory
- Third Party Advisory
- Third Party AdvisoryVDB Entry
- Third Party AdvisoryVDB Entry
- Issue TrackingPatch
- Third Party Advisory
- Vendor Advisory
- Vendor Advisory
Уязвимые конфигурации
Одно из
EPSS
5.9 Medium
CVSS3
4.3 Medium
CVSS2
Дефекты
Связанные уязвимости
Add-on updates failed to verify that the add-on ID inside the signed package matched the ID of the add-on being updated. An attacker who could perform a man-in-the-middle attack on the user's connection to the update server and defeat the certificate pinning protection could provide a malicious signed add-on instead of a valid update. This vulnerability affects Firefox ESR < 45.5 and Firefox < 50.
Add-on updates failed to verify that the add-on ID inside the signed package matched the ID of the add-on being updated. An attacker who could perform a man-in-the-middle attack on the user's connection to the update server and defeat the certificate pinning protection could provide a malicious signed add-on instead of a valid update. This vulnerability affects Firefox ESR < 45.5 and Firefox < 50.
Add-on updates failed to verify that the add-on ID inside the signed p ...
Add-on updates failed to verify that the add-on ID inside the signed package matched the ID of the add-on being updated. An attacker who could perform a man-in-the-middle attack on the user's connection to the update server and defeat the certificate pinning protection could provide a malicious signed add-on instead of a valid update. This vulnerability affects Firefox ESR < 45.5 and Firefox < 50.
EPSS
5.9 Medium
CVSS3
4.3 Medium
CVSS2