PT-2015-4903 · Mozilla+3 · Firefox+3

Alex · Publicado 2015-02-24 · Atualizado 2024-12-12 · CVE-2015-0834

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Mozilla Firefox versions prior to 36.0

Description The issue concerns the WebRTC subsystem in Mozilla Firefox, which recognizes turns: and stuns: URIs but accesses the TURN or STUN server without using TLS. This makes it easier for man-in-the-middle attackers to discover credentials by spoofing a server and completing a brute-force attack within a short time window.

Recommendations For versions prior to 36.0, update to version 36.0 or later to resolve the issue.

Exploit

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

ALT-PU-2015-1275

ALT-PU-2015-1464

CVE-2015-0834

OPENSUSE-SU-2015_0404-1

OPENSUSE-SU-2024:10071-1

OPENSUSE-SU-2024:14572-1

USN-2505-1

USN-2505-2

Produtos afetados

Alt Linux

Firefox

Suse

Ubuntu

Referências · 2231

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/firefox_pdfjs_privilege_escalation.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/firefox_proxy_prototype.rb · Exploit
• https://suse.com/security/cve/CVE-2009-0354 · Nota
• https://bdu.fstec.ru/vul/2015-09904 · Nota de Segurança
• https://suse.com/security/cve/CVE-2024-3302 · Nota
• https://suse.com/security/cve/CVE-2024-1551 · Nota
• https://suse.com/security/cve/CVE-2012-1937 · Nota
• https://suse.com/security/cve/CVE-2023-25731 · Nota
• https://suse.com/security/cve/CVE-2009-1307 · Nota
• https://suse.com/security/cve/CVE-2020-6812 · Nota
• https://suse.com/security/cve/CVE-2024-4769 · Nota
• https://suse.com/security/cve/CVE-2016-5282 · Nota
• https://suse.com/security/cve/CVE-2010-1210 · Nota
• https://suse.com/security/cve/CVE-2009-3381 · Nota
• https://suse.com/security/cve/CVE-2016-2798 · Nota