PT-2015-1050 · Mozilla+3 · Firefox+3

Muneaki Nishimura · Published 2015-04-03 · Updated 2024-12-12 · CVE-2015-0799

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Mozilla Firefox versions prior to 37.0.1

Description The issue allows man-in-the-middle attackers to bypass an intended X.509 certificate-verification step for an SSL server. This is achieved by specifying the server in the uri-host field of an Alt-Svc HTTP/2 response header, thus enabling the attacker to control network traffic and modify the server address.

Recommendations For versions prior to 37.0.1, update to version 37.0.1 or later to resolve the issue.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

ALT-PU-2015-1374

ALT-PU-2015-1464

BDU:2015-09904

CVE-2015-0799

MGASA-2015-0342

OPENSUSE-SU-2015_0677-1

OPENSUSE-SU-2024:10071-1

OPENSUSE-SU-2024:14572-1

USN-2557-1

Affected Products

Alt Linux

Firefox

Suse

Ubuntu

References · 2244

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/firefox_pdfjs_privilege_escalation.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/firefox_proxy_prototype.rb · Exploit
• https://bdu.fstec.ru/vul/2015-09904 · Security Note
• https://bdu.fstec.ru/vul/2015-09888 · Security Note
• https://bdu.fstec.ru/vul/2015-09892 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1584 · Security Note
• https://mozilla.org/en-US/security/advisories/mfsa2015-51 · Vendor Advisory
• https://mozilla.org/en-US/security/advisories/mfsa2015-40 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1581 · Security Note
• https://bdu.fstec.ru/vul/2015-09816 · Security Note
• https://bdu.fstec.ru/vul/2015-09901 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0824 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2717 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2716 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0835 · Security Note