Privilege escalation using crypto.generateCRMFRequest — Mozilla

2006-04-1300:00:00

Mozilla Foundation

www.mozilla.org

CVSS2

9.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

EPSS

0.261

Percentile

96.8%

JSON

shutdown demonstrated that the crypto.generateCRMFRequest method can be used to run arbitrary code with the privilege of the user, which could enable an attacker to install malware.

Affected configurations

Vulners

Node

mozillafirefoxRange<1.0.8

mozillafirefoxRange<1.5.0.2

mozillamozilla_suiteRange<1.7.13

mozillaseamonkeyRange<1.0.1

mozillathunderbirdRange<1.0.8

mozillathunderbirdRange<1.5.0.2

VendorProductVersionCPE
mozillafirefox*cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*
mozillamozilla_suite*cpe:2.3:a:mozilla:mozilla_suite:*:*:*:*:*:*:*:*
mozillaseamonkey*cpe:2.3:a:mozilla:seamonkey:*:*:*:*:*:*:*:*
mozillathunderbird*cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
mozilla	firefox	*	cpe:2.3:a:mozilla:firefox::::::::
mozilla	mozilla_suite	*	cpe:2.3:a:mozilla:mozilla_suite::::::::
mozilla	seamonkey	*	cpe:2.3:a:mozilla:seamonkey::::::::
mozilla	thunderbird	*	cpe:2.3:a:mozilla:thunderbird::::::::