Published: 11/06/2018 Updated: 14/08/2018

CVSS v2 Base Score: 4.6 | Impact Score: 6.4 | Exploitability Score: 3.9

CVSS v3 Base Score: 7.8 | Impact Score: 5.9 | Exploitability Score: 1.8

VMScore: 410

Vector: AV:L/AC:L/Au:N/C:P/I:P/A:P

The Mozilla Windows updater modifies some files to be updated by reading the original file and applying changes to it. The location of the original file can be altered by a malicious user by passing a special path to the callback parameter through the Mozilla Maintenance Service, allowing the manipulation of files in the installation directory and privilege escalation by manipulating the Mozilla Maintenance Service, which has privileged access. Note: This attack requires local system access and only affects Windows. Other operating systems are not affected. This vulnerability affects Firefox ESR < 52.2 and Firefox < 54.

Vulnerable Product	Search on Vulmon	Subscribe to Product
mozilla firefox
mozilla firefox_esr

Mozilla Foundation Security Advisory 2017-16 Security vulnerabilities fixed in Firefox ESR 522 Announced June 13, 2017 Impact critical Products Firefox ESR Fixed in Firefox ESR 522 ...

Mozilla Foundation Security Advisory 2017-15 Security vulnerabilities fixed in Firefox 54 Announced June 13, 2017 Impact critical Products Firefox Fixed in Firefox 54 ...

Red Team: Summary of Operations Table of Contents Exposed Services Critical Vulnerabilities Exploitation Exposed Services Nmap scan results for each machine reveal the below services and OS details: $ nmap #nmap 19216810/24 -sV This scan identifies the services below as potential points of entry: Target 1 Port 22 - Open SSH Po

Wordpress - Red and Blue Teaming to identify attack vectors and find ways to defend against the attacks

Wordpress_Red_Blue_Teaming Red Team: Summary of Operations Table of Contents Exposed Services Critical Vulnerabilities Exploitation Exposed Services Target 1 List of Exposed Services Ports - 22/tcp - ssh 80/tcp - http 111/tcp - rpcbind Nmap scan results for each machine reveal the below services and OS details: $ nmap -sV -sC 1921681110

CWE-417 https://www.mozilla.org/security/advisories/mfsa2017-16/https://www.mozilla.org/security/advisories/mfsa2017-15/https://bugzilla.mozilla.org/show_bug.cgi?id=1348645 http://www.securitytracker.com/id/1038689 http://www.securityfocus.com/bid/99057 https://nvd.nist.gov https://github.com/nmuhammad22/UPennFinalProject https://github.com/saib2018/Wordpress_Red_Blue_Teaming https://www.mozilla.org/en-US/security/advisories/mfsa2017-16/

CVE-2017-7760

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

Github Repositories

References

Vulmon Search

About

Products

Connect