PT-2010-4790 · Mozilla · Firefox

Amit Klein · Published 2010-09-15 · Updated 2017-09-19 · CVE-2010-3399

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Mozilla Firefox versions 3.5.10 through 3.5.11 Mozilla Firefox versions 3.6.4 through 3.6.8 Mozilla Firefox version 4.0 Beta1

Description The issue concerns the js InitRandom function in the JavaScript implementation, which uses a context pointer in conjunction with its successor pointer for seeding a random number generator. This makes it easier for remote attackers to guess the seed value via a brute-force attack.

Recommendations For Mozilla Firefox versions 3.5.10 through 3.5.11, update to a version that fixes this issue. For Mozilla Firefox versions 3.6.4 through 3.6.8, update to a version that fixes this issue. For Mozilla Firefox version 4.0 Beta1, update to a version that fixes this issue.

Exploit

Fix

Weakness Enumeration

CWE-310

Related Identifiers

CVE-2010-3399

Affected Products

Firefox

References · 9

• 🔥 http://trusteer.com/sites/default/files/Cross_domain_Math_Random_leakage_in_FF_3.6.4-3.6.8.pdf · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2010-3399 · Security Note
• https://bugzilla.mozilla.org/show_bug.cgi?id=577512 · Note
• https://bugzilla.mozilla.org/show_bug.cgi?id=475585 · Note
• http://vupen.com/english/advisories/2011/0061 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7598 · Note
• http://blogs.sun.com/security/entry/multiple_vulnerabilities_in_mozilla_firefox · Note
• http://secunia.com/advisories/42867 · Note
• http://archives.neohapsis.com/archives/bugtraq/2010-09/0117.html · Note