CVE-2022-26387

Mozilla: Time-of-check time-of-use bug when verifying add-on signatures

Severity Score

7.5

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

When installing an add-on, Firefox verified the signature before prompting the user; but while the user was confirming the prompt, the underlying add-on file could have been modified and Firefox would not have noticed. This vulnerability affects Firefox < 98, Firefox ESR < 91.7, and Thunderbird < 91.7.

Al instalar un complemento, Firefox verificaba la firma antes de avisar al usuario; pero mientras el usuario confirmaba el mensaje, el archivo complementario subyacente podría haberse modificado y Firefox no se habría dado cuenta. Esta vulnerabilidad afecta a Firefox < 98, Firefox ESR < 91,7 y Thunderbird < 91.7.

A flaw was found in Mozilla. The Mozilla Foundation Security Advisory describes this flaw as follows: When installing an add-on, Firefox verified the signature before prompting the user; but while the user was confirming the prompt, the underlying add-on file could have been modified, and Firefox would not have noticed.

*Credits: N/A

CVSS Scores

NISTv3.1 7.5

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2022-03-03 CVE Reserved
2022-03-11 CVE Published
2024-08-03 CVE Updated
2024-08-03 First Exploit
2024-08-12 EPSS Updated
---------- Exploited in Wild
---------- KEV Due Date

CWE

CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition

CAPEC

References (6)

URL	Tag	Source

URL	Date	SRC
https://bugzilla.mozilla.org/show_bug.cgi?id=1752979	2024-08-03

URL	Date	SRC

URL	Date	SRC
https://www.mozilla.org/security/advisories/mfsa2022-10	2022-12-30
https://www.mozilla.org/security/advisories/mfsa2022-11	2022-12-30
https://www.mozilla.org/security/advisories/mfsa2022-12	2022-12-30
https://access.redhat.com/security/cve/CVE-2022-26387	2022-03-14
https://bugzilla.redhat.com/show_bug.cgi?id=2062222	2022-03-14

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Mozilla Search vendor "Mozilla"		Firefox Search vendor "Mozilla" for product "Firefox"				< 98.0 Search vendor "Mozilla" for product "Firefox" and version " < 98.0"		-		Affected
Mozilla Search vendor "Mozilla"		Firefox Esr Search vendor "Mozilla" for product "Firefox Esr"				< 91.7 Search vendor "Mozilla" for product "Firefox Esr" and version " < 91.7"		-		Affected
Mozilla Search vendor "Mozilla"		Thunderbird Search vendor "Mozilla" for product "Thunderbird"				< 91.7 Search vendor "Mozilla" for product "Thunderbird" and version " < 91.7"		-		Affected