Wifi direct system messages don't require a permission

Related Vulnerabilities: CVE-2015-4494  

Mozilla Foundation Security Advisory 2015-76

Wifi direct system messages don't require a permission

Announced
August 6, 2015
Reporter
Paul Theriault
Impact
Low
Products
Firefox OS
Fixed in
  • Firefox OS 2.2

Description

Paul Theriault of Mozilla discovered a privacy issue with a WiFi-related system message that wasn't properly restricted to apps with the "wifi-manage" permission. As a result, even unprivileged apps could have received those messages, allowing them to extract limited information from a vulnerable Firefox OS device under certain rare conditions.

References