PT-2014-4216 · Mozilla · Firefox

Published 2014-03-29 · Updated 2014-03-31 · CVE-2014-1516

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Mozilla Firefox versions through 28.0.1

Description The issue relies on Android's weak approach to seeding the Math.random function, making it easier for attackers to bypass a profile-randomization protection mechanism via a crafted application. This is related to the saltProfileName function in base/GeckoProfileDirectories.java.

Recommendations For versions through 28.0.1, update to a version that addresses this issue to prevent attackers from bypassing the profile-randomization protection mechanism.

Exploit

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2014-1516

Affected Products

Firefox

References · 4

• 🔥 http://securityintelligence.com/vulnerabilities-firefox-android-overtaking-firefox-profiles · Exploit
• 🔥 http://slideshare.net/ibmsecurity/overtaking-firefox-profiles-vulnerabilities-in-firefox-for-android · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2014-1516 · Security Note
• http://archives.neohapsis.com/archives/bugtraq/2014-03/0153.html · Note