vendor:
Firefox
by:
Jeremy Brown
7.5
CVSS
HIGH
Local File Inclusion
22
CWE
Product Name: Firefox
Affected Version From: Mozilla Firefox 3.5.3
Affected Version To:
Patch Exists: NO
Related CWE:
CPE: a:mozilla:firefox:3.5.3
Platforms Tested: Linux, Mac
2009
Mozilla Firefox 3.5.3 Local Download Manager Exploit
When downloading files through Firefox and choosing the "Open with" option, Firefox will create a temporary file in the form of RANDOM.part. When the download completes, Firefox saves the completed file in the "/tmp" directory as its original filename and opens it with the program's handler. However, if there is already a file with an identical filename in the temporary file directory, Firefox saves and opens the newly downloaded file using a naming scheme that appends a dash and the next available number in order. This vulnerability allows local users to write a malicious file with the same name as the intended file and have Firefox open it instead.
Mitigation:
Ensure that the temporary file directory is secure and cannot be written to by unauthorized users. Regularly clean out the temporary file directory to prevent accumulation of potentially malicious files.
