Both Windows and Linux users actively being targeted.
If, like me, you are suffering from vulnerability fatigue after so many flaws and weaknesses having been disclosed in Las Vegas this week, you may be tempted to ignore the
advisory
Mozilla
released yesterday. However, I strongly advise you don’t.
The company says it has been made aware of a vulnerability in the PDF reader built into its flagship
Firefox
browser. The vulnerability allows an attacker to create a specially crafted PDF that injects JavaScript code into the local file context. This could be used to upload local files to a server controlled by the attacker.
So far, there are no signs that the vulnerability allows for remote code to be executed on the target’s machine, thus making it less likely to be included into exploit kits, yet that doesn’t mean users of the browser shouldn’t been concerned.
Indeed, the vulnerability is already known to have been exploited in the wild, apparently through advertisements on a Russian news site. This exploit targeted both
Windows
and
Linux
machines. In the former case it looked for configuration files for programs like
Filezilla
and
subversion
, obviously looking for credentials that could be exploited.
On
Linux
, the exploit unsurprisingly uploaded the
/etc/passwd
file, as well as private SSH keys and Bash and MySQL history. It is not hard to imagine how an attacker could use this information. Currently, no attacks against
Mac
users have been spotted, but they are just as vulnerable.
If you are using
Firefox
, you are urged to upgrade to version 39.0.3 of the browser, which patches the vulnerability. Or, if you are running the extended support release, to version 38.1.1. If you’re a
Linux
user, it might also be a good opportunity to think about whether you want your shell and MySQL histories to be stored on disk.
Posted on 07 August 2015 by
Martijn Grooten
Leave a Reply