PT-2015-4903 · Mozilla+3 · Firefox+3

Alex · Published 2015-02-24 · Updated 2024-12-12 · CVE-2015-0834

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Mozilla Firefox versions prior to 36.0

Description The issue concerns the WebRTC subsystem in Mozilla Firefox, which recognizes turns: and stuns: URIs but accesses the TURN or STUN server without using TLS. This makes it easier for man-in-the-middle attackers to discover credentials by spoofing a server and completing a brute-force attack within a short time window.

Recommendations For versions prior to 36.0, update to version 36.0 or later to resolve the issue.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

ALT-PU-2015-1275

ALT-PU-2015-1464

CVE-2015-0834

OPENSUSE-SU-2015_0404-1

OPENSUSE-SU-2024:10071-1

OPENSUSE-SU-2024:14572-1

USN-2505-1

USN-2505-2

Affected Products

Alt Linux

Firefox

Suse

Ubuntu

References · 2231

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/firefox_pdfjs_privilege_escalation.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/firefox_proxy_prototype.rb · Exploit
• https://bdu.fstec.ru/vul/2015-09904 · Security Note
• https://bdu.fstec.ru/vul/2015-09888 · Security Note
• https://bdu.fstec.ru/vul/2015-09892 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1584 · Security Note
• http://ubuntu.com/usn/USN-2505-1 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1581 · Security Note
• https://bdu.fstec.ru/vul/2015-09816 · Security Note
• https://bdu.fstec.ru/vul/2015-09901 · Security Note
• https://ubuntu.com/security/CVE-2015-0819 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0824 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2717 · Security Note
• http://mozilla.org/security/announce/2015/mfsa2015-15.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2716 · Security Note