PT-2023-4835 · Mozilla · Vpn

Matthias Gerstner · Published 2023-08-30 · Updated 2023-09-13 · CVE-2023-4104

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Mozilla VPN client for Linux versions prior to 2.16.1

Description The issue is related to an invalid Polkit Authentication check and missing authentication requirements for D-Bus methods, allowing any local user to configure arbitrary VPN setups. This bug only affects Mozilla VPN on Linux, with other operating systems being unaffected.

Recommendations For Mozilla VPN client for Linux versions prior to 2.16.1, update to version 2.16.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the D-Bus methods until a patch is available.

Exploit

Fix

Missing Authorization

Improper Authentication

Weakness Enumeration

CWE-862

CWE-287

Related Identifiers

BDU:2023-05321

CVE-2023-4104

Affected Products

Vpn

References · 18

• 🔥 https://openwall.com/lists/oss-security/2023/08/03/1 · Exploit
• 🔥 https://bugzilla.mozilla.org/show_bug.cgi?id=1831318 · Exploit
• https://github.com/mozilla-mobile/mozilla-vpn-client/pull/7055 · Patch
• https://github.com/mozilla-mobile/mozilla-vpn-client/pull/7110 · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-4104 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-4104 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-4104 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2023-4104 · Security Note
• https://mozilla.org/security/advisories/mfsa2023-39 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-4104 · Security Note
• https://bdu.fstec.ru/vul/2023-05321 · Security Note
• https://github.com/mozilla-mobile/mozilla-vpn-client · Note
• https://github.com/mozilla-mobile/mozilla-vpn-client/pull/7151 · Note
• https://cybersecurity-help.cz/vdb/SB2023090434 · Note
• https://t.me/cibsecurity/70187 · Telegram Post