You are currently viewing a snapshot of www.mozilla.org taken on April 21, 2008. Most of this content is highly out of date (some pages haven't been updated since the project began in 1998) and exists for historical purposes only. If there are any pages on this archive site that you think should be added back to www.mozilla.org, please file a bug.

Skip to main content

You are here: Known Vulnerabilities in Mozilla Products (Firefox 1.5.0.7) > MFSA 2006-58

Mozilla Foundation Security Advisory 2006-58

Title: Auto-update compromise through DNS and SSL spoofing
Impact: Moderate
Announced: September 14, 2006
Reporter: Jon Oberheide
Products: Firefox, Thunderbird

Fixed in: Firefox 1.5.0.7
  Thunderbird 1.5.0.7

Description

The Firefox and Thunderbird auto-update mechanism protects itself against DNS spoofing using SSL; only a site presenting a valid certificate for aus2.mozilla.org will be trusted as a source of update information. Jon Oberheide points out, however, that many users accept unverifiable self-signed certificates without much thought on "low value" sites, and this could be used as the basis of an attack on the update system.

The attacker would have to be in a position to spoof the victim's DNS, causing them to connect to sites of the attacker's choosing rather than the sites intended by the victim. If they gained that control and the victim accepted the attacker's cert for the Mozilla update site, then the next update check could be hijacked and redirected to the attacker's site without detection. The attacker could then send an "update" that consisted of whatever programs they wished.

Workaround

Do not accept unverifiable (often self-signed) certificates as valid. If you must, accept them for the session only, never permanently. If you have approved such a certificate during that session exit the client completely and restart before checking for or accepting automatic updates.

References