Mozilla Firefox和Thunderbird IPC message安全绕过漏洞

详细信息

漏洞类型

输入验证错误

漏洞描述

Mozilla Firefox和Mozilla Firefox ESR都是美国Mozilla基金会的产品。Mozilla Firefox是一款开源Web浏览器。Mozilla Firefox ESR是Firefox(Web浏览器)的一个延长支持版本。Mozilla Firefox可能允许远程攻击者绕过安全限制，这是由于对通过Prompt:Open IPC消息在子进程和父进程之间传递的参数的审查不足而导致的。通过说服受害者访问特制网站，远程攻击者可以利用此漏洞使用Prompt:Open IPC消息将任意内容从沙盒子进程打开到非沙盒父进程。

修复建议

目前厂商已发布升级补丁以修复漏洞，补丁获取链接： https://www.mozilla.org/en-US/security/advisories/mfsa2019-19/ https://www.mozilla.org/en-US/security/advisories/mfsa2019-20/

参考链接

• https://bugzilla.mozilla.org/show_bug.cgi?id=1559858

  OSV · x_refsource_MISC

• https://www.mozilla.org/security/advisories/mfsa2019-20/

  OSV · x_refsource_MISC

• https://www.mozilla.org/en-US/security/advisories/mfsa2019-19/
• http://www.mozilla.org/
• https://www.mozilla.org/security/advisories/mfsa2019-19/

  OSV · x_refsource_MISC

• https://security.gentoo.org/glsa/201908-12

  OSV · vendor-advisory · x_refsource_GENTOO

• https://access.redhat.com/errata/RHSA-2019:1604
• https://access.redhat.com/errata/RHSA-2019:1603
• https://usn.ubuntu.com/4032-1/
• https://vigilance.fr/vulnerability/Firefox-Thunderbird-privilege-escalation-via-Prompt-Open-Sandbox-Escape-29590
• https://packetstormsecurity.com/files/153414/Ubuntu-Security-Notice-USN-4032-1.html
• https://packetstormsecurity.com/files/153432/Red-Hat-Security-Advisory-2019-1603-01.html
• https://www.auscert.org.au/bulletins/ESB-2019.2291/
• https://www.ibm.com/support/pages/node/1127571
• https://packetstormsecurity.com/files/155592/Mozilla-Firefox-Windows-64-Bit-Chain-Exploit.html

  NVD · VDB Entry · Third Party Advisory

• https://www.auscert.org.au/bulletins/ESB-2019.2274/
• http://packetstormsecurity.com/files/155592/Mozilla-Firefox-Windows-64-Bit-Chain-Exploit.html

  OSV · x_refsource_MISC

• https://osv.dev/vulnerability/CVE-2019-11708

  OSV

• https://osv.dev/vulnerability/DSA-4474-1

  OSV

• https://osv.dev/vulnerability/DLA-1836-1

  OSV

• https://osv.dev/vulnerability/DSA-4471-1

  OSV

• https://security.alpinelinux.org/vuln/CVE-2019-11708

  OSV

• https://security-tracker.debian.org/tracker/CVE-2019-11708

  OSV

• https://ubuntu.com/security/CVE-2019-11708

  OSV

• https://www.mozilla.org/en-US/security/advisories/mfsa2019-19/#CVE-2019-11708

  OSV

• https://ubuntu.com/security/notices/USN-4032-1

  OSV

• https://ubuntu.com/security/notices/USN-4045-1

  OSV

• https://www.cve.org/CVERecord?id=CVE-2019-11708

  OSV

• https://www.cisa.gov/known-exploited-vulnerabilities-catalog

  OSV

• https://osv.dev/vulnerability/UBUNTU-CVE-2019-11708

  OSV

• https://osv.dev/vulnerability/DEBIAN-CVE-2019-11708

  OSV

• https://osv.dev/vulnerability/ALPINE-CVE-2019-11708

  OSV

• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-11708

  NVD · US Government Resource