Update Firefox 39.03 Now! to Patch Critical File Stealing Vulnerability
Earlier this week, Mozilla Security researcher Cody Crews discovered a malicious advertisement on a Russian news site that steals local files from a system and upload them to a Ukrainian server without the user ever knowing.
Mozilla released a security patch for the Firefox browser after finding a serious vulnerability being exploited in the wild. The vulnerability allows malicious attackers to use some JavaScript magic to “search for and upload potentially sensitive” from your hard drive to their servers.
The malicious advertisement was exploiting a serious vulnerability in Firefox's PDF Viewer and the JavaScript context in order to inject a script capable of searching sensitive files on user's local file systems.
Mozilla versions of Firefox that do not contain the PDF Viewer, such as Firefox for Android, are not affected by the "Same origin violation and local file stealing via PDF reader" vulnerability.
Mozilla is asking all Firefox users to upgrade immediately to version 39.0.3. Anyone on the Firefox Extended Support release via their school or business should upgrade to version 38.1.1.
Mozilla first became aware of the flaw after a Firefox user noticed that an ad embedded on a Russian news site was using an exploit to search for sensitive files. The malware would then upload the sensitive files to a server in the Ukraine. This all appears to happen in the background with the user none the wiser. The malware also leaves no trace it was ever on your machine.
The specific exploit found in the wild was only targeting Windows and Linux PCs; however, Veditz warns that Mac users would be vulnerable if the malware had been crafted differently.
The exploit does not execute any arbitrary code but injects a JavaScript payload into the local file context, allowing the script to search for and upload potentially user’s sensitive local files.
All an attacker need to do is load the page with this exploit and sit back and relax. The exploit will silently steal files in the background.
According to Mozilla lead security researcher Daniel Veditz the specific exploit found in the wild was only targeting Windows and Linux PCs; however, Veditz warns that Mac users would be vulnerable if the malware had been crafted differently.
The exploit specifically searches for:
Any files encountered by the exploit are uploaded to a server in Ukraine.
Mac users are currently safe from this exploit, but researcher warned that another payload could potentially exploit the same vulnerability to target Mac systems.
Mozilla released a security patch for the Firefox browser after finding a serious vulnerability being exploited in the wild. The vulnerability allows malicious attackers to use some JavaScript magic to “search for and upload potentially sensitive” from your hard drive to their servers.
The malicious advertisement was exploiting a serious vulnerability in Firefox's PDF Viewer and the JavaScript context in order to inject a script capable of searching sensitive files on user's local file systems.
Mozilla versions of Firefox that do not contain the PDF Viewer, such as Firefox for Android, are not affected by the "Same origin violation and local file stealing via PDF reader" vulnerability.
Mozilla is asking all Firefox users to upgrade immediately to version 39.0.3. Anyone on the Firefox Extended Support release via their school or business should upgrade to version 38.1.1.
Mozilla first became aware of the flaw after a Firefox user noticed that an ad embedded on a Russian news site was using an exploit to search for sensitive files. The malware would then upload the sensitive files to a server in the Ukraine. This all appears to happen in the background with the user none the wiser. The malware also leaves no trace it was ever on your machine.
The specific exploit found in the wild was only targeting Windows and Linux PCs; however, Veditz warns that Mac users would be vulnerable if the malware had been crafted differently.
The exploit does not execute any arbitrary code but injects a JavaScript payload into the local file context, allowing the script to search for and upload potentially user’s sensitive local files.
All an attacker need to do is load the page with this exploit and sit back and relax. The exploit will silently steal files in the background.
According to Mozilla lead security researcher Daniel Veditz the specific exploit found in the wild was only targeting Windows and Linux PCs; however, Veditz warns that Mac users would be vulnerable if the malware had been crafted differently.
The exploit specifically searches for:
- FTP configuration files, subversion, s3browser, Filezilla, libpurple, the PSI Plus and Pidgin chat clients that are popular choices for encrypted, off-the-record messaging and other account information on Windows systems.
- Global configuration files and user directories on Linux systems.
"The exploit leaves no trace it has been run on the local machine," Veditz wrote in a blog post. "If you use Firefox on Windows or Linux it would be prudent to change any passwords and keys found in the above-mentioned files if you use the associated programs. If not, you should still update your browser as soon as possible in case other, as-yet-unknown exploits are looking for sensitive files you do have on your system. "
Any files encountered by the exploit are uploaded to a server in Ukraine.
Mac users are currently safe from this exploit, but researcher warned that another payload could potentially exploit the same vulnerability to target Mac systems.
No comments
Post a Comment