CVE-2017-5409 : The Mozilla Windows updater can be called by a non-privileged user to delete an arbitrary local file by passing a specia

The Mozilla Windows updater can be called by a non-privileged user to delete an arbitrary local file by passing a special path to the callback parameter through the Mozilla Maintenance Service, which has privileged access. Note: This attack requires local system access and only affects Windows. Other operating systems are not affected. This vulnerability affects Firefox ESR < 45.8 and Firefox < 52.

Published 2018-06-11 21:29:04

Updated 2019-10-03 00:03:26

Source Mozilla Corporation

View at NVD, CVE.org

Products affected by CVE-2017-5409

Mozilla » Firefox
Versions before (<) 52.0
cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*
Matching versions
When used together with: Microsoft » Windows » Version: N/A
Mozilla » Firefox Esr
Versions before (<) 45.8.0
cpe:2.3:a:mozilla:firefox_esr:*:*:*:*:*:*:*:*
Matching versions
When used together with: Microsoft » Windows » Version: N/A

Exploit prediction scoring system (EPSS) score for CVE-2017-5409

EPSS FAQ

0.07%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 31 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2017-5409

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
3.6	LOW	AV:L/AC:L/Au:N/C:N/I:P/A:P	3.9	4.9	NIST
Access Vector: Local Access Complexity: Low Authentication: None Confidentiality Impact: None Integrity Impact: Partial Availability Impact: Partial
5.5	MEDIUM	CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N	1.8	3.6	NIST
Attack Vector: Local Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: None Integrity: High Availability: None

CWE ids for CVE-2017-5409

CWE-269 Improper Privilege Management

The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2017-5409

https://www.mozilla.org/security/advisories/mfsa2017-05/

Security vulnerabilities fixed in Firefox 52 — Mozilla
Vendor Advisory

CVEs referencing this url
https://bugzilla.mozilla.org/show_bug.cgi?id=1321814

1321814 - (CVE-2017-5409) Maintenance Service Updater Callback Parameter File Deletion Elevation of Privilege
Exploit;Issue Tracking
https://www.mozilla.org/security/advisories/mfsa2017-06/

Security vulnerabilities fixed in Firefox ESR 45.8 — Mozilla
Vendor Advisory

CVEs referencing this url
http://www.securitytracker.com/id/1037966

Mozilla Firefox Multiple Bugs Let Remote Users Bypass Security Restrictions, Spoof URLs, Obtain Potentially Sensitive Information, Deny Service, and Execute Arbitrary Code - SecurityTracker
Third Party Advisory;VDB Entry

CVEs referencing this url
http://www.securityfocus.com/bid/96696

Mozilla Firefox CVE-2017-5409 Arbitrary File Deletion Vulnerability
Third Party Advisory;VDB Entry

Jump to

Vulnerability Details : CVE-2017-5409

Products affected by CVE-2017-5409

Exploit prediction scoring system (EPSS) score for CVE-2017-5409

CVSS scores for CVE-2017-5409

CWE ids for CVE-2017-5409

References for CVE-2017-5409