PT-2010-4615 · Mozilla · Firefox

Amit Klein · Published 2010-09-15 · Updated 2017-09-19 · CVE-2010-3171

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Mozilla Firefox versions 3.5.10 through 3.5.11 Mozilla Firefox versions 3.6.4 through 3.6.8 Mozilla Firefox version 4.0 Beta1

Description The issue is related to the Math.random function in the JavaScript implementation, which uses a random number generator seeded only once per document object. This makes it easier for remote attackers to track a user or trick a user into acting upon a spoofed pop-up message by calculating the seed value. The issue is related to a "temporary footprint" and an "in-session phishing attack."

Recommendations For Mozilla Firefox versions 3.5.10 through 3.5.11, update to a version that correctly fixes the random number generator seeding issue. For Mozilla Firefox versions 3.6.4 through 3.6.8, update to a version that correctly fixes the random number generator seeding issue. For Mozilla Firefox version 4.0 Beta1, update to a version that correctly fixes the random number generator seeding issue.

Exploit

Fix

Weakness Enumeration

CWE-310

Related Identifiers

CVE-2010-3171

Affected Products

Firefox

References · 10

• 🔥 http://trusteer.com/sites/default/files/Cross_domain_Math_Random_leakage_in_FF_3.6.4-3.6.8.pdf · Exploit
• 🔥 http://securityfocus.com/bid/43222 · Exploit
• 🔥 https://exploit-db.com/exploits/34621 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2010-3171 · Security Note
• http://vupen.com/english/advisories/2011/0061 · Note
• http://archives.neohapsis.com/archives/bugtraq/2010-09/0117.html · Note
• https://bugzilla.mozilla.org/show_bug.cgi?id=577512 · Note
• http://secunia.com/advisories/42867 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7370 · Note
• http://blogs.sun.com/security/entry/multiple_vulnerabilities_in_mozilla_firefox · Note