#cve2024 — Public Fediverse posts

High-Impact Security Vulnerabilities in Firefox 128

Date: July 9, 2024
CVE: CVE-2024-6605 CVE-2024-6606 CVE-2024-6607 CVE-2024-6608 CVE-2024-6609 CVE-2024-6610 CVE-2024-6600 CVE-2024-6601 CVE-2024-6602 CVE-2024-6603 CVE-2024-6611 CVE-2024-6612 CVE-2024-6613 CVE-2024-6614 CVE-2024-6604 CVE-2024-6615
Vulnerability Type: Tapjacking
CWE: [[CWE-451]], [[CWE-922]]
Sources: Mozilla Security Advisory

Synopsis

Multiple security vulnerabilities were addressed in the latest Firefox 128 release, impacting both the desktop and Android versions. These vulnerabilities, if exploited, could lead to severe security breaches including tapjacking, out-of-bounds read, and memory corruption.

A list of all the CVEs mentioned in the Mozilla Foundation Security Advisory 2024-29:

1. CVE-2024-6605: Firefox Android missed activation delay to prevent tapjacking (High)
2. CVE-2024-6606: Out-of-bounds read in clipboard component (High)
3. CVE-2024-6607: Leaving pointerlock by pressing the escape key could be prevented (Moderate)
4. CVE-2024-6608: Cursor could be moved out of the viewport using pointerlock (Moderate)
5. CVE-2024-6609: Memory corruption in NSS (Moderate)
6. CVE-2024-6610: Form validation popups could block exiting full-screen mode (Moderate)
7. CVE-2024-6600: Memory corruption in WebGL API (Moderate)
8. CVE-2024-6601: Race condition in permission assignment (Moderate)
9. CVE-2024-6602: Memory corruption in NSS (Moderate)
10. CVE-2024-6603: Memory corruption in thread creation (Moderate)
11. CVE-2024-6611: Incorrect handling of SameSite cookies (Low)
12. CVE-2024-6612: CSP violation leakage when using devtools (Low)
13. CVE-2024-6613: Incorrect listing of stack frames (Low)
14. CVE-2024-6614: Incorrect listing of stack frames (Low)
15. CVE-2024-6604: Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13, and Thunderbird 115.13 (High)
16. CVE-2024-6615: Memory safety bugs fixed in Firefox 128 (High)

Issue Summary

Mozilla announced fixes for several high-impact vulnerabilities in Firefox 128. Notably, CVE-2024-6606 which involves out-of-bounds read issues in the clipboard component, and CVE-2024-6609 related to memory corruption in the NSS library.

Technical Key Findings

CVE-2024-6605 allows attackers to overlay malicious prompts over legitimate permission dialogs, potentially tricking users into granting unwanted permissions. This vulnerability exploits the lack of a delay in activating permission prompts on Firefox Android, enabling immediate interactions which can be hijacked by malicious actors.

Vulnerable Products

• Firefox versions prior to 128
• Firefox ESR versions prior to 115.13
• Firefox Android versions prior to 128

Impact Assessment

If these vulnerabilities are exploited, attackers can perform actions such as reading out-of-bounds data, preventing users from exiting fullscreen mode, or executing arbitrary code. These can lead to unauthorized access to sensitive data, manipulation of browser behavior, and potential system compromises.

Patches or Workaround

Mozilla has released patches in Firefox 128, Firefox ESR 115.13, and Thunderbird 115.13 to address these vulnerabilities. Users are advised to update to the latest versions to mitigate the risks associated with these security flaws.

Tags

#Firefox #CVE2024-6605 #Tapjacking #SecurityUpdate #Mozilla #Vulnerability #MemoryCorruption #OutOfBoundsRead

"🚨 Critical Vulnerability Alert: ConnectWise ScreenConnect Under Attack! 🚨"

Sophos researchers have unveiled a situation for users of ConnectWise ScreenConnect, detailing how CVE-2024-1709 and CVE-2024-1708 vulnerabilities are being exploited to deliver malware, including the notorious LockBit ransomware. These vulnerabilities open the door for attackers to execute arbitrary code and take control of unpatched systems.

ConnectWise ScreenConnect, a remote access software, has vulnerabilities being exploited by hackers to deliver malware, including ransomware, to businesses. Critical vulnerabilities allow unauthorized access and command execution. It's essential to update ScreenConnect to version 23.9.8 or later to mitigate these risks. Cloud-hosted ScreenConnect users are safe, but on-premise versions need manual updates.

To protect your organization from specific security weaknesses in ScreenConnect software, follow these simplified steps:

1. Find all ScreenConnect software in your network, including those managed by others. It's essential to know where it's installed to understand your risk.
2. Isolate or remove the ScreenConnect Client from devices until the server is securely updated or thoroughly checked. If you don't control the server, removing the client might be the best quick fix.
3. Examine devices with ScreenConnect for signs of hacking, like new unknown user accounts, strange software behavior, and attempts to disable security features.
4. If you find anything suspicious, start your incident response plan to tackle the issue and prevent further damage. Specifically, look for indicators of two main vulnerabilities (CVE-2024-1709 & CVE-2024-1708) by examining server versions, IP connections, and unexpected file presence, which could show a breach. 🛡️💻🔐

Tags: #CyberSecurity #ConnectWiseScreenConnect #Vulnerability #Malware #Ransomware #LockBit #CVE2024-1709 #CVE2024-1708 #UpdateNow #StaySecure

Source: Sophos News