CVE-2019-11707, CVE-2019-11708:Multiple Zero-Day Vulnerabilities in Mozilla Firefox Exploited in the Wild
Security researchers discover two zero-day vulnerabilities in Mozilla Firefox used in targeted attacks.
Editor’s Note: This blog was updated on June 20 to reflect additional information regarding a second vulnerability used in combination with CVE-2019-11707, as well as security updates from Mozilla.
Antecedentes
On June 18 and June 20, the Mozilla Foundation published security advisories [1, 2] to address two zero-day vulnerabilities in Mozilla Firefox being used in targeted attacks in the wild.
Análisis
According to the first security advisory, CVE-2019-11707 is a type confusion vulnerability in Mozilla Firefox that can result in an exploitable crash due to issues in Array.pop which can occur when manipulating JavaScript objects. In the second security advisory, CVE-2019-11708 is a sandbox escape vulnerability in Prompt:Open Inter-process communication (IPC) messages due to insufficient vetting of parameters. An attacker could exploit this vulnerability to cause a non-sandboxed parent process to open web content from a compromised child process using a specially crafted Prompt:Open IPC message between the child and parent process. Combining both CVE-2019-11708 and CVE-2019-11707 can result in arbitrary code execution.
The vulnerabilities were reported to Mozilla by Google Project Zero’s Samuel Groß and the Coinbase Security team.
Samuel Groß provided additional context about the vulnerability in Tweets posted on June 19. Groß mentions he did not have details about the active exploitation in the wild and that he reported the bug back in April. He noted that while remote code execution (RCE) is possible, it would “need a separate sandbox escape.” Finally, he did mention that on its own, the vulnerability “can also be exploited for Universal Cross-Site Scripting (UXSS) which might be enough depending on the attacker’s goals.”
The bug can be exploited for RCE but would then need a separate sandbox escape. However, most likely it can also be exploited for UXSS which might be enough depending on the attacker's goals. Looking forward to more details from @mozsec and @coinbase
— Samuel Groß (@5aelo) June 19, 2019
Philip Martin, Chief Information Security Officer (CISO) at Coinbase, published a series of Tweets on June 20 providing additional context around the targeted attack. According to Martin, CVE-2019-11707 was used in conjunction with a separate Firefox zero-day sandbox escape vulnerability (CVE-2019-11708) to target Coinbase employees. Martin added that Coinbase wasn’t the only “crypto org” targeted in this attack campaign and his team has provided indicators of compromise (IOCs) to assist other organizations.
1/ A little more context on the Firefox 0-day reports. On Monday, Coinbase detected & blocked an attempt by an attacker to leverage the reported 0-day, along with a separate 0-day firefox sandbox escape, to target Coinbase employees.
— Philip Martin (@SecurityGuyPhil) June 19, 2019
Additionally, Patrick Wardle, Founder and Chief Research Officer (CRO) for Digita Security, published a blog analyzing a macOS malware sample sent to him that matches one of the malicious files referenced by Philip Martin in his Tweets.
Solución
Mozilla released Firefox 67.0.3 and Firefox Extended Support Release (ESR) 60.7.1 on June 18 to address CVE-2019-11707 and released Firefox 67.0.4 and Firefox ESR 60.7.2 on June 20 to address CVE-2019-11708. Users are advised to upgrade to the latest versions of Firefox as soon as possible.
Identificación de los sistemas afectados
A list of Tenable plugins to identify these vulnerabilities will appear here as they’re released.
Obtenga más información
Únase al Equipo de respuesta de seguridad de Tenable en Tenable Community.
Learn more about Tenable, the first Cyber Exposure platform for holistic management of your modern attack surface. Get a free 60-day trial of Tenable.io.
Artículos relacionados
Cybersecurity Snapshot: Find MITRE ATT&CK Complex? Need Help Mapping to It? There’s an App for That!
March 10, 2023Learn about a new tool that streamlines MITRE ATT&CK mapping. Plus, known vulnerabilities remain a major cyber risk – just ask LastPass. Also, discover why SaaS data protection remains difficult. Plus, a look at the U.S. National Cybersecurity Strategy. And much more!
The Ransomware Ecosystem: In Pursuit of Fame and Fortune
July 28, 2022The key players within the ransomware ecosystem, including affiliates and initial access brokers, work together cohesively like a band of musicians, playing their respective parts as they strive for fame and fortune.
Brazen, Unsophisticated and Illogical: Understanding the LAPSUS$ Extortion Group
July 20, 2022Having gained the industry’s attention in the first months of 2022, the LAPSUS$ extortion group has largely gone quiet. What can we learn from this extortion group’s story and tactics?
Cybersecurity Snapshot: New Guide Explains How To Assess if Software Is Secure by Design, While NIST Publishes GenAI Risk Framework
May 10, 2024Is the software your company wants to buy securely designed? A new guide outlines how you can find out. Meanwhile, a new NIST framework can help you assess your GenAI systems’ risks. Plus, a survey shows a big disconnect between AI usage (high) and AI governance (low). And MITRE’s breach post-mortem brims with insights and actionable tips. And much more!
CVE-2024-21793, CVE-2024-26026: Proof of Concept Available for F5 BIG-IP Next Central Manager Vulnerabilities
May 9, 2024Researchers disclose multiple vulnerabilities in F5 BIG-IP Next Central Manager and provide proof-of-concept exploit code, which could lead to exposure of hashed passwords.
Cybersecurity Snapshot: Attackers Pounce on Unpatched Vulns, DBIR Says, as Critical Infrastructure Orgs Benefit from CISA’s Alert Program
May 3, 2024Verizon’s DBIR found that hackers are having a field day exploiting vulnerabilities to gain initial access. Plus, a CISA program is helping critical infrastructure organizations prevent ransomware attacks. In addition, check out what Tenable’s got planned for RSA Conference 2024. And get the latest on the Change Healthcare breach. And much more!
- Threat Intelligence
- Threat Management
- Vulnerability Management
- Vulnerability Scanning