| VID |
28928 |
| Severity |
40 |
| Port |
139,445 |
| Protocol |
TCP |
| Class |
SMB |
| Detailed Description |
The version of Firefox installed on the remote Windows host is prior to 92.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2021-38 advisory.
- Firefox for Android allowed navigations through the `intent://` protocol, which could be used to cause crashes and UI spoofs. This bug only affects Firefox for Android. Other operating systems are unaffected. (CVE-2021-29993)
- Mixed-content checks were unable to analyze opaque origins which led to some mixed content being loaded.
(CVE-2021-38491)
- When delegating navigations to the operating system, Firefox would accept the `mk` scheme which might allow attackers to launch pages and execute scripts in Internet Explorer in unprivileged mode. This bug only affects Firefox for Windows. Other operating systems are unaffected. (CVE-2021-38492)
- Mozilla developers Gabriele Svelto and Tyson Smith reported memory safety bugs present in Firefox 91 and Firefox ESR 78.13. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. (CVE-2021-38493)
- Mozilla developers Christian Holler and Lars T Hansen reported memory safety bugs present in Firefox 91.
Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. (CVE-2021-38494)
* Note: This check requires an account with Guest or upper privileges which can access the registry of the remote host to scan. Absence of this condition will result in the check not being performed and a False Negative for all vulnerable hosts.
* References:
https://www.mozilla.org/en-US/security/advisories/mfsa2021-38/
* Platforms Affected:
Mozilla Foundation, Firefox versions prior to 92.0
Any operating system Any version |
| Recommendation |
Upgrade to the latest version of Firefox (92.0 or later), available from the Mozilla Web site at http://www.mozilla.com/firefox/ |
| Related URL |
CVE-2021-29993,CVE-2021-38491,CVE-2021-38492,CVE-2021-38493,CVE-2021-38494 (CVE) |
| Related URL |
(SecurityFocus) |
| Related URL |
(ISS) |
|
