PT-2012-3673 · Mozilla+1 · Thunderbird+3

Curtis Koenig + 2 · Publicado 2012-06-05 · Atualizado 2017-12-29 · CVE-2012-1942

Positive Technologies (AI Summary)

CVSS v2.0

7.2

Alta

Vetor base

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Mozilla Firefox version 12.0 Thunderbird version 12.0 SeaMonkey version 2.9

Description The issue allows local users to gain privileges by loading a DLL file in a privileged context, affecting Mozilla Firefox, Thunderbird, and SeaMonkey on Windows.

Recommendations For Mozilla Firefox version 12.0, consider restricting the loading of DLL files in privileged contexts until a patch is available. For Thunderbird version 12.0, restrict the loading of DLL files in privileged contexts to minimize the risk of exploitation. For SeaMonkey version 2.9, avoid using privileged contexts that may load DLL files until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

LPE

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2012-1942

SUSE-SU-2013_1152-1

Produtos afetados

Firefox

Seamonkey

Suse

Thunderbird

Referências · 67

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/mozilla_firefox_onreadystatechange.rb · Exploit
• 🔥 https://github.com/vlad902/annotated-fbi-tbb-exploit · Exploit
• http://mozilla.org/security/announce/2013/mfsa2013-35.html · Nota
• http://lists.opensuse.org/opensuse-security-announce/2012-06/msg00012.html · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1672 · Nota de Segurança
• https://mozilla.org/en-US/security/advisories/mfsa2013-45 · Aviso do Fabricante
• http://lists.suse.com/mailman/listinfo/sle-security-updates · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0797 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0792 · Nota de Segurança
• http://support.novell.com/security/cve/CVE-2013-1686.html · Nota
• https://bugzilla.mozilla.org/show_bug.cgi?id=827106 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1687 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1942 · Nota de Segurança
• http://support.novell.com/security/cve/CVE-2013-1685.html · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1673 · Nota de Segurança