PT-2014-4216 · Mozilla · Firefox

Publicado 2014-03-29 · Atualizado 2014-03-31 · CVE-2014-1516

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Mozilla Firefox versions through 28.0.1

Description The issue relies on Android's weak approach to seeding the Math.random function, making it easier for attackers to bypass a profile-randomization protection mechanism via a crafted application. This is related to the saltProfileName function in base/GeckoProfileDirectories.java.

Recommendations For versions through 28.0.1, update to a version that addresses this issue to prevent attackers from bypassing the profile-randomization protection mechanism.

Exploit

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2014-1516

Produtos afetados

Firefox

Referências · 4

• 🔥 http://securityintelligence.com/vulnerabilities-firefox-android-overtaking-firefox-profiles · Exploit
• 🔥 http://slideshare.net/ibmsecurity/overtaking-firefox-profiles-vulnerabilities-in-firefox-for-android · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2014-1516 · Nota de Segurança
• http://archives.neohapsis.com/archives/bugtraq/2014-03/0153.html · Nota