PT-2012-2571 · Mozilla+1 · Firefox+2

Magicant Starmen · Published 2012-01-31 · Updated 2017-09-19 · CVE-2012-0450

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Low

Base vector

AV:L/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Mozilla Firefox versions 4.x through 9.0 SeaMonkey versions prior to 2.7

Description The issue allows local users to potentially read a Firefox Sync key via standard filesystem operations due to weak permissions set for Firefox Recovery Key.html on Linux and Mac OS X systems.

Recommendations For Mozilla Firefox versions 4.x through 9.0, update to a version outside of this range to resolve the issue. For SeaMonkey versions prior to 2.7, update to version 2.7 or later to resolve the issue.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2012-0450

Affected Products

Firefox

Seamonkey

Suse

References · 10

• http://lists.opensuse.org/opensuse-security-announce/2012-02/msg00011.html · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDVSA-2012:013 · Vendor Advisory
• http://mozilla.org/security/announce/2012/mfsa2012-09.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2012-0450 · Security Note
• https://mozilla.org/en-US/security/advisories/mfsa2012-09 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0450 · Security Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14670 · Note
• https://bugzilla.mozilla.org/show_bug.cgi?id=716868 · Note
• http://osvdb.org/78741 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/72869 · Note