Vulnerabilities > CVE-2019-17021 - Race Condition vulnerability in multiple products
Attack vector
NETWORK Attack complexity
HIGH Privileges required
NONE Confidentiality impact
HIGH Integrity impact
NONE Availability impact
NONE Summary
During the initialization of a new content process, a race condition occurs that can allow a content process to disclose heap addresses from the parent process. *Note: this issue only occurs on Windows. Other operating systems are unaffected.*. This vulnerability affects Firefox ESR < 68.4 and Firefox < 72.
Vulnerable Configurations
Common Weakness Enumeration (CWE)
Common Attack Pattern Enumeration and Classification (CAPEC)
- Leveraging Race Conditions This attack targets a race condition occurring when multiple processes access and manipulate the same resource concurrently and the outcome of the execution depends on the particular order in which the access takes place. The attacker can leverage a race condition by "running the race", modifying the resource and modifying the normal execution flow. For instance a race condition can occur while accessing a file, the attacker can trick the system by replacing the original file with his version and cause the system to read the malicious file.
- Leveraging Time-of-Check and Time-of-Use (TOCTOU) Race Conditions This attack targets a race condition occurring between the time of check (state) for a resource and the time of use of a resource. The typical example is the file access. The attacker can leverage a file access race condition by "running the race", meaning that he would modify the resource between the first time the target program accesses the file and the time the target program uses the file. During that period of time, the attacker could do something such as replace the file and cause an escalation of privilege.
Nessus
NASL family SuSE Local Security Checks NASL id OPENSUSE-2020-60.NASL description This update for MozillaFirefox fixes the following issues : - Firefox Extended Support Release 68.4.1 ESR - Fixed: Security fix MFSA 2020-03 (bsc#1160498) - CVE-2019-17026 (bmo#1607443) IonMonkey type confusion with StoreElementHole and FallibleStoreElement - Firefox Extended Support Release 68.4.0 ESR - Fixed: Various security fixes MFSA 2020-02 (bsc#1160305) - CVE-2019-17015 (bmo#1599005) Memory corruption in parent process during new content process initialization on Windows - CVE-2019-17016 (bmo#1599181) Bypass of @namespace CSS sanitization during pasting - CVE-2019-17017 (bmo#1603055) Type Confusion in XPCVariant.cpp - CVE-2019-17021 (bmo#1599008) Heap address disclosure in parent process during content process initialization on Windows - CVE-2019-17022 (bmo#1602843) CSS sanitization does not escape HTML tags - CVE-2019-17024 (bmo#1507180, bmo#1595470, bmo#1598605, bmo#1601826) Memory safety bugs fixed in Firefox 72 and Firefox ESR 68.4 This update was imported from the SUSE:SLE-15:Update update project. last seen 2020-06-01 modified 2020-06-02 plugin id 132949 published 2020-01-16 reporter This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/132949 title openSUSE Security Update : MozillaFirefox (openSUSE-2020-60) code # # (C) Tenable Network Security, Inc. # # The descriptive text and package checks in this plugin were # extracted from openSUSE Security Update openSUSE-2020-60. # # The text description of this plugin is (C) SUSE LLC. # include("compat.inc"); if (description) { script_id(132949); script_version("1.4"); script_cvs_date("Date: 2020/02/14"); script_cve_id("CVE-2019-17015", "CVE-2019-17016", "CVE-2019-17017", "CVE-2019-17021", "CVE-2019-17022", "CVE-2019-17024", "CVE-2019-17026"); script_name(english:"openSUSE Security Update : MozillaFirefox (openSUSE-2020-60)"); script_summary(english:"Check for the openSUSE-2020-60 patch"); script_set_attribute( attribute:"synopsis", value:"The remote openSUSE host is missing a security update." ); script_set_attribute( attribute:"description", value: "This update for MozillaFirefox fixes the following issues : - Firefox Extended Support Release 68.4.1 ESR - Fixed: Security fix MFSA 2020-03 (bsc#1160498) - CVE-2019-17026 (bmo#1607443) IonMonkey type confusion with StoreElementHole and FallibleStoreElement - Firefox Extended Support Release 68.4.0 ESR - Fixed: Various security fixes MFSA 2020-02 (bsc#1160305) - CVE-2019-17015 (bmo#1599005) Memory corruption in parent process during new content process initialization on Windows - CVE-2019-17016 (bmo#1599181) Bypass of @namespace CSS sanitization during pasting - CVE-2019-17017 (bmo#1603055) Type Confusion in XPCVariant.cpp - CVE-2019-17021 (bmo#1599008) Heap address disclosure in parent process during content process initialization on Windows - CVE-2019-17022 (bmo#1602843) CSS sanitization does not escape HTML tags - CVE-2019-17024 (bmo#1507180, bmo#1595470, bmo#1598605, bmo#1601826) Memory safety bugs fixed in Firefox 72 and Firefox ESR 68.4 This update was imported from the SUSE:SLE-15:Update update project." ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1160305" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1160498" ); script_set_attribute( attribute:"solution", value:"Update the affected MozillaFirefox packages." ); script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P"); script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C"); script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"); script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C"); script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:MozillaFirefox"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:MozillaFirefox-branding-upstream"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:MozillaFirefox-buildsymbols"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:MozillaFirefox-debuginfo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:MozillaFirefox-debugsource"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:MozillaFirefox-devel"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:MozillaFirefox-translations-common"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:MozillaFirefox-translations-other"); script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:opensuse:15.1"); script_set_attribute(attribute:"vuln_publication_date", value:"2020/01/08"); script_set_attribute(attribute:"patch_publication_date", value:"2020/01/15"); script_set_attribute(attribute:"plugin_publication_date", value:"2020/01/16"); script_set_attribute(attribute:"generated_plugin", value:"current"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof."); script_family(english:"SuSE Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/SuSE/release", "Host/SuSE/rpm-list", "Host/cpu"); exit(0); } include("audit.inc"); include("global_settings.inc"); include("rpm.inc"); if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); release = get_kb_item("Host/SuSE/release"); if (isnull(release) || release =~ "^(SLED|SLES)") audit(AUDIT_OS_NOT, "openSUSE"); if (release !~ "^(SUSE15\.1)$") audit(AUDIT_OS_RELEASE_NOT, "openSUSE", "15.1", release); if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING); ourarch = get_kb_item("Host/cpu"); if (!ourarch) audit(AUDIT_UNKNOWN_ARCH); if (ourarch !~ "^(x86_64)$") audit(AUDIT_ARCH_NOT, "x86_64", ourarch); flag = 0; if ( rpm_check(release:"SUSE15.1", reference:"MozillaFirefox-68.4.1-lp151.2.24.1") ) flag++; if ( rpm_check(release:"SUSE15.1", reference:"MozillaFirefox-branding-upstream-68.4.1-lp151.2.24.1") ) flag++; if ( rpm_check(release:"SUSE15.1", reference:"MozillaFirefox-buildsymbols-68.4.1-lp151.2.24.1") ) flag++; if ( rpm_check(release:"SUSE15.1", reference:"MozillaFirefox-debuginfo-68.4.1-lp151.2.24.1") ) flag++; if ( rpm_check(release:"SUSE15.1", reference:"MozillaFirefox-debugsource-68.4.1-lp151.2.24.1") ) flag++; if ( rpm_check(release:"SUSE15.1", reference:"MozillaFirefox-devel-68.4.1-lp151.2.24.1") ) flag++; if ( rpm_check(release:"SUSE15.1", reference:"MozillaFirefox-translations-common-68.4.1-lp151.2.24.1") ) flag++; if ( rpm_check(release:"SUSE15.1", reference:"MozillaFirefox-translations-other-68.4.1-lp151.2.24.1") ) flag++; if (flag) { if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get()); else security_warning(0); exit(0); } else { tested = pkg_tests_get(); if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested); else audit(AUDIT_PACKAGE_NOT_INSTALLED, "MozillaFirefox / MozillaFirefox-branding-upstream / etc"); }NASL family SuSE Local Security Checks NASL id OPENSUSE-2020-94.NASL description This update for MozillaThunderbird to version 68.4.1 fixes the following issues : Security issues fixed : - CVE-2019-17026: IonMonkey type confusion with StoreElementHole and FallibleStoreElement - CVE-2019-17016: Bypass of @namespace CSS sanitization during pasting - CVE-2019-17017: Type Confusion in XPCVariant.cpp - CVE-2019-17022: CSS sanitization does not escape HTML tags - CVE-2019-17024: multiple Memory safety bugs fixed Non-security issues fixed : - Various improvements when setting up an account for a Microsoft Exchange server. For example better detection for Office 365 accounts. This update was imported from the SUSE:SLE-15:Update update project. last seen 2020-06-01 modified 2020-06-02 plugin id 133199 published 2020-01-23 reporter This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/133199 title openSUSE Security Update : MozillaThunderbird (openSUSE-2020-94) NASL family SuSE Local Security Checks NASL id SUSE_SU-2020-0068-1.NASL description This update for MozillaFirefox fixes the following issues : Firefox Extended Support Release 68.4.1 ESR - Fixed: Security fix MFSA 2020-03 (bsc#1160498) - CVE-2019-17026 (bmo#1607443) IonMonkey type confusion with StoreElementHole and FallibleStoreElement Firefox Extended Support Release 68.4.0 ESR - Fixed: Various security fixes MFSA 2020-02 (bsc#1160305) - CVE-2019-17015 (bmo#1599005) Memory corruption in parent process during new content process initialization on Windows - CVE-2019-17016 (bmo#1599181) Bypass of @namespace CSS sanitization during pasting - CVE-2019-17017 (bmo#1603055) Type Confusion in XPCVariant.cpp - CVE-2019-17021 (bmo#1599008) Heap address disclosure in parent process during content process initialization on Windows - CVE-2019-17022 (bmo#1602843) CSS sanitization does not escape HTML tags - CVE-2019-17024 (bmo#1507180, bmo#1595470, bmo#1598605, bmo#1601826) Memory safety bugs fixed in Firefox 72 and Firefox ESR 68.4 Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-06-01 modified 2020-06-02 plugin id 132852 published 2020-01-13 reporter This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/132852 title SUSE SLED12 / SLES12 Security Update : MozillaFirefox (SUSE-SU-2020:0068-1) NASL family Windows NASL id MOZILLA_FIREFOX_68_4_ESR.NASL description The version of Firefox ESR installed on the remote Windows host is prior to 68.4. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2020-02 advisory. - During the initialization of a new content process, a pointer offset can be manipulated leading to memory corruption and a potentially exploitable crash in the parent process. Note: this issue only occurs on Windows. Other operating systems are unaffected. (CVE-2019-17015) - When pasting a <style> tag from the clipboard into a rich text editor, the CSS sanitizer incorrectly rewrites a @namespace rule. This could allow for injection into certain types of websites resulting in data exfiltration. (CVE-2019-17016) - Due to a missing case handling object types, a type confusion vulnerability could occur, resulting in a crash. We presume that with enough effort that it could be exploited to run arbitrary code. (CVE-2019-17017) - During the initialization of a new content process, a race condition occurs that can allow a content process to disclose heap addresses from the parent process. Note: this issue only occurs on Windows. Other operating systems are unaffected. (CVE-2019-17021) - When pasting a <style> tag from the clipboard into a rich text editor, the CSS sanitizer does not escape < and > characters. Because the resulting string is pasted directly into the text node of the element this does not result in a direct injection into the webpage; however, if a webpage subsequently copies the node last seen 2020-06-01 modified 2020-06-02 plugin id 132711 published 2020-01-08 reporter This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/132711 title Mozilla Firefox ESR < 68.4 Multiple Vulnerabilities NASL family Windows NASL id MOZILLA_THUNDERBIRD_68_4_1.NASL description The version of Thunderbird installed on the remote Windows host is prior to 68.4.1. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2020-04 advisory. - During the initialization of a new content process, a pointer offset can be manipulated leading to memory corruption and a potentially exploitable crash in the parent process. *Note: this issue only occurs on Windows. Other operating systems are unaffected.*. This vulnerability affects Thunderbird < 68.4. (CVE-2019-17015) - When pasting a <style> tag from the clipboard into a rich text editor, the CSS sanitizer incorrectly rewrites a @namespace rule. This could allow for injection into certain types of websites resulting in data exfiltration. This vulnerability affects Thunderbird < 68.4. (CVE-2019-17016) - Due to a missing case handling object types, a type confusion vulnerability could occur, resulting in a crash. We presume that with enough effort that it could be exploited to run arbitrary code. This vulnerability affects Thunderbird < 68.4. (CVE-2019-17017) - During the initialization of a new content process, a race condition occurs that can allow a content process to disclose heap addresses from the parent process. *Note: this issue only occurs on Windows. Other operating systems are unaffected.*. This vulnerability affects Thunderbird < 68.4. (CVE-2019-17021) - When pasting a <style> tag from the clipboard into a rich text editor, the CSS sanitizer does not escape < and > characters. Because the resulting string is pasted directly into the text node of the element this does not result in a direct injection into the webpage; however, if a webpage subsequently copies the node last seen 2020-06-01 modified 2020-06-02 plugin id 132774 published 2020-01-10 reporter This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/132774 title Mozilla Thunderbird < 68.4.1 NASL family Slackware Local Security Checks NASL id SLACKWARE_SSA_2020-010-01.NASL description New mozilla-thunderbird packages are available for Slackware 14.2 and -current to fix security issues. last seen 2020-06-01 modified 2020-06-02 plugin id 132847 published 2020-01-13 reporter This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/132847 title Slackware 14.2 / current : mozilla-thunderbird (SSA:2020-010-01) NASL family Windows NASL id MOZILLA_FIREFOX_72_0.NASL description The version of Firefox installed on the remote Windows host is prior to 72.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2020-01 advisory, including the following: - During the initialization of a new content process, a pointer offset can be manipulated leading to memory corruption and a potentially exploitable crash in the parent process. (CVE-2019-17015) - When pasting a <style> tag from the clipboard into a rich text editor, the CSS sanitizer incorrectly rewrites a @namespace rule. This could allow for injection into certain types of websites resulting in data exfiltration. (CVE-2019-17016) - Due to a missing case handling object types, a type confusion vulnerability could occur, resulting in a crash. We presume that with enough effort that it could be exploited to run arbitrary code. (CVE-2019-17017) - When in Private Browsing Mode on Windows 10, the Windows keyboard may retain word suggestions to improve the accuracy of the keyboard. (CVE-2019-17018) - When Python was installed on Windows, a python file being served with the MIME type of text/plain could be executed by Python instead of being opened as a text file when the Open option was selected upon download. (CVE-2019-17019) - If an XML file is served with a Content Security Policy and the XML file includes an XSL stylesheet, the Content Security Policy will not be applied to the contents of the XSL stylesheet. If the XSL sheet e.g. includes JavaScript, it would bypass any of the restrictions of the Content Security Policy applied to the XML document. (CVE-2019-17020) - During the initialization of a new content process, a race condition occurs that can allow a content process to disclose heap addresses from the parent process. (CVE-2019-17021) - When pasting a <style> tag from the clipboard into a rich text editor, the CSS sanitizer does not escape < and > characters. Because the resulting string is pasted directly into the text node of the element this does not result in a direct injection into the webpage; however, if a webpage subsequently copies the node last seen 2020-06-01 modified 2020-06-02 plugin id 132709 published 2020-01-08 reporter This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/132709 title Mozilla Firefox < 72.0 Multiple Vulnerabilities NASL family SuSE Local Security Checks NASL id SUSE_SU-2020-0078-1.NASL description This update for MozillaFirefox fixes the following issues : Firefox Extended Support Release 68.4.1 ESR - Fixed: Security fix MFSA 2020-03 (bsc#1160498) - CVE-2019-17026 (bmo#1607443) IonMonkey type confusion with StoreElementHole and FallibleStoreElement Firefox Extended Support Release 68.4.0 ESR - Fixed: Various security fixes MFSA 2020-02 (bsc#1160305) - CVE-2019-17015 (bmo#1599005) Memory corruption in parent process during new content process initialization on Windows - CVE-2019-17016 (bmo#1599181) Bypass of @namespace CSS sanitization during pasting - CVE-2019-17017 (bmo#1603055) Type Confusion in XPCVariant.cpp - CVE-2019-17021 (bmo#1599008) Heap address disclosure in parent process during content process initialization on Windows - CVE-2019-17022 (bmo#1602843) CSS sanitization does not escape HTML tags - CVE-2019-17024 (bmo#1507180, bmo#1595470, bmo#1598605, bmo#1601826) Memory safety bugs fixed in Firefox 72 and Firefox ESR 68.4 Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-06-01 modified 2020-06-02 plugin id 132921 published 2020-01-15 reporter This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/132921 title SUSE SLED15 / SLES15 Security Update : MozillaFirefox (SUSE-SU-2020:0078-1)
References
- http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00029.html
- http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00029.html
- http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00043.html
- http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00043.html
- http://packetstormsecurity.com/files/155912/Slackware-Security-Advisory-mozilla-thunderbird-Updates.html
- http://packetstormsecurity.com/files/155912/Slackware-Security-Advisory-mozilla-thunderbird-Updates.html
- https://bugzilla.mozilla.org/show_bug.cgi?id=1599008
- https://bugzilla.mozilla.org/show_bug.cgi?id=1599008
- https://seclists.org/bugtraq/2020/Jan/18
- https://seclists.org/bugtraq/2020/Jan/18
- https://www.mozilla.org/security/advisories/mfsa2020-01/
- https://www.mozilla.org/security/advisories/mfsa2020-01/
- https://www.mozilla.org/security/advisories/mfsa2020-02/
- https://www.mozilla.org/security/advisories/mfsa2020-02/