Mozilla/Firefox Linux Installation Arbitrary File Overwrite (deprecated)

Low Nessus Network Monitor Plugin ID 2281

Synopsis

The remote host is vulnerable to a flaw that allows attackers to retrieve sensitive files or data.

Description

The remote host seems to be running Mozilla or Firefox for Linux. It is reported that versions up to and include 0.9.3 of Firefox and up to and including 1.7.2 of Mozilla are prone to an improper file permission issue in the installation process. Upon installation, several files are created with world-writable permissions. An attacker with interactive access to the host may corrupt these scripts and programs during the installation process. This vulnerability exists only in the Linux archive version. If you installed Firefox using your Linux distribution packaging system, the vulnerability is likely not present on the remote system.

Solution

Upgrade or patch according to vendor recommendations.

Plugin Details

Severity: Low

ID: 2281

Family: Web Clients

Published: 2004/09/13

Modified: 2018/09/16

Dependencies: 1769

Risk Information

Risk Factor: Low

CVSSv2

Base Score: 2.1

Temporal Score: 1.8

Vector: CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:N

Temporal Vector: CVSS2#E:H/RL:OF/RC:C

CVSSv3

Base Score: 3.9

Temporal Score: 3.7

Vector: CVSS3#AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Temporal Vector: CVSS3#E:H/RL:O/RC:C

Vulnerability Information

CPE: cpe:/a:mozilla:firefox

Reference Information

CVE: CVE-2004-0906

BID: 11166, 11192