SB2020112919 - Improperly implemented security check for standard in firefox (Alpine package)

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2020112919

SB2020112919 - Improperly implemented security check for standard in firefox (Alpine package)

Published: November 29, 2020

Security Bulletin ID SB2020112919
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Improperly implemented security check for standard (CVE-ID: CVE-2020-26961)

CWE-ID: CWE-358 - Improperly Implemented Security Check for Standard

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote attacker to perform a DNS rebinding attack.

The vulnerability exists due to the way Firefox filters IPv4 mapped IP addresses. When DNS over HTTPS is in use, it intentionally filters RFC1918 and related IP ranges from the responses as these do not make sense coming from a DoH resolver. However when an IPv4 address was mapped through IPv6, these addresses were erroneously let through, leading to a potential DNS Rebinding attack.


Remediation

Install update from vendor's website.

References