Zero-day vulnerability in Mozilla Firefox

Security bypass
CVE-2015-4495

In August 2016 Mozilla bug-tracking service was hacked. Hackers were able to steal information about not yet patched vulnerabilities in Mozilla Firefox and use one of them in a targeted attack against users of Russian news website.

The malicious exfiltration server, hosted in Ukraine, has been online since July 27, 2015.

The vulnerability was reported by researcher Cody Crews.

Known malware:

JS/Exploit.CVE-2015-4495 (ESET).

Vulnerability details

Advisory: SB2016080501 - Security bypass in Mozilla Firefox

Vulnerable component: Mozilla Firefox

CVE-ID: CVE-2015-4495

CVSSv3 score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H/E:H/RL:O/RC:C

CWE-ID: CWE-20 - Improper input validation

Description:

The vulnerabiity allows a remote attacker to bypass security restrictions on the target system.

The weakness exists due to improper input validation. A remote attacker can create a specially crafted PDF file, trick the victim into opening it, bypass same-origin policy and inject arbitrary JavaScript into the built-in PDF Viewer to gain access to arbitrary files on the system.

Successful exploitation of this vulnerability may result in access to local files and privilege escalation, leading to system compromise.

Note: the vulnerability was being actively exploited.

Known APT campaigns:

Russian media website breach

Some specialists relate attack to the Duqu malware.

The malicious server, situated in Ukraine, has been active since July 27, 2015.

Public Exploits:

- Mozilla Firefox < 39.03 - 'pdf.js' Same Origin Policy Exploit [Exploit-DB]

External links:

http://www.computerworld.com/article/2980745/web-browsers/mozilla-admits-bug-tracker-breach-led-to-a...
https://www.mozilla.org/en-US/security/advisories/mfsa2015-78/
https://blog.mozilla.org/security/2015/08/06/firefox-exploit-found-in-the-wild/
http://www.welivesecurity.com/2015/08/11/firefox-under-fire-anatomy-of-latest-0-day-attack/
http://www.securityweek.com/mozilla-patches-firefox-zero-day-exploited-wild
https://www.redpacketsecurity.com/firefox-0day-cve-2015-4495/
https://access.redhat.com/articles/1563163
https://www.symantec.com/connect/blogs/firefox-vulnerability-could-allow-attackers-steal-documents
http://securityaffairs.co/wordpress/39198/cyber-crime/0-day-firefox.html
https://www.hedgehogsecurity.co.uk/firefox-users-should-update-immediately/
https://www.eset.com/int/about/newsroom/company/firefox-0-day-attack/

About zero-day vulnerabilities

Zero-day vulnerability is an undisclosed vulnerability in software that hackers can exploit to compromise computer programs, gain unauthorized access to sensitive data, penetrate networks, etc. We consider vulnerability a zero-day when there is no solution provided from software vendor and the vulnerability is being actively exploited by malicious actors.

Zero-day candidate is a potential zero-day vulnerability in software which might have been used in targeted attacks, however there is no evidence to support this suggestion.