[Forgot Password]
Login  Register Subscribe

23631

 
 

115038

 
 

95906

 
 

909

 
 

77986

 
 

109

Paid content will be excluded from the download.


Download | Alert*
OVAL

Mozilla Products: Firefox full and stub installer DLL hijacking - mfsa2013-74

ID: oval:org.secpod.oval:def:16337Date: (C)2013-12-30   (M)2017-09-22
Class: PATCHFamily: macos




Security researcher Robert Kugler reported in 2012 that when a specifically named DLL file on a Windows computer is placed in the default downloads directory with the Firefox installer, the Firefox installer will load this DLL file when it is launched. Mozilla developers Brian Bondy and Robert Strong then discovered that the stub installer was vulnerable to this same issue with a number of DLL files and there were additionally vulnerable named DLL files with the full installer. In circumstances where an installer is run by an administrator privileged account, this allows for a downloaded DLL file to be run with those administrator privileges.

Platform:
Apple Mac OS X 10.8
Apple Mac OS X 10.9
Apple Mac OS X 10.10
Apple Mac OS X 10.11
Apple Mac OS X 10.12
Apple Mac OS X Server 10.8
Apple Mac OS X Server 10.9
Apple Mac OS X Server 10.10
Apple Mac OS X Server 10.11
Apple Mac OS X Server 10.12
Product:
Mozilla SeaMonkey
Mozilla Firefox
Reference:
MFSA 2013-74
CVE-2013-1715
CVE    1
CVE-2013-1715
CPE    9
cpe:/a:mozilla:seamonkey
cpe:/a:mozilla:firefox:21.0
cpe:/a:mozilla:firefox:22.0
cpe:/a:mozilla:firefox:20.0
...

© 2013 SecPod Technologies