Lucene search

K
mozillaMozilla FoundationMFSA2015-76
HistoryAug 06, 2015 - 12:00 a.m.

Wifi direct system messages don't require a permission — Mozilla

2015-08-0600:00:00
Mozilla Foundation
www.mozilla.org
28

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:N/A:N

AI Score

6

Confidence

High

EPSS

0.002

Percentile

52.7%

Paul Theriault of Mozilla discovered a privacy issue with a WiFi-related system message that wasn’t properly restricted to apps with the “wifi-manage” permission. As a result, even unprivileged apps could have received those messages, allowing them to extract limited information from a vulnerable Firefox OS device under certain rare conditions.

Affected configurations

Vulners
Node
mozillafirefox_osRange<2.2
VendorProductVersionCPE
mozillafirefox_os*cpe:2.3:o:mozilla:firefox_os:*:*:*:*:*:*:*:*

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:N/A:N

AI Score

6

Confidence

High

EPSS

0.002

Percentile

52.7%