CVE-2013-1700

The Mozilla Maintenance Service in Mozilla Firefox before 22.0 on Windows does not properly handle inability to launch the Mozilla Updater executable file, which allows local users to gain privileges via vectors involving placement of a Trojan horse executable file at an arbitrary location.

CVSS v2.0 7.2 HIGH

7.2^/10

CVSS v2.0 : HIGH

Vector : AV:L/AC:L/Au:N/C:C/I:C/A:C

Exploitability : 3.9 / Impact : 10.0

Access Vector LOCAL

Access Complexity LOW

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
http://www.mozilla.org/security/announce/2013/mfsa2013-62.html	Vendor Advisory
https://bugzilla.mozilla.org/show_bug.cgi?id=867056
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A17126
http://www.mozilla.org/security/announce/2013/mfsa2013-62.html	Vendor Advisory
https://bugzilla.mozilla.org/show_bug.cgi?id=867056
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A17126

Configurations

Configuration 1 (hide)

AND

OR	cpe:2.3:a:mozilla:firefox::::::::
	cpe:2.3:a:mozilla:firefox:19.0:::::::*
	cpe:2.3:a:mozilla:firefox:19.0.1:::::::*
	cpe:2.3:a:mozilla:firefox:19.0.2:::::::*
	cpe:2.3:a:mozilla:firefox:20.0:::::::*
	cpe:2.3:a:mozilla:firefox:20.0.1:::::::*

cpe:2.3:o:microsoft:windows:*:*:*:*:*:*:*:*

History

21 Nov 2024, 01:50

Type	Values Removed	Values Added
References	~~() http://www.mozilla.org/security/announce/2013/mfsa2013-62.html - Vendor Advisory~~	() http://www.mozilla.org/security/announce/2013/mfsa2013-62.html - Vendor Advisory
References	~~() https://bugzilla.mozilla.org/show_bug.cgi?id=867056 -~~	() https://bugzilla.mozilla.org/show_bug.cgi?id=867056 -
References	~~() https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A17126 -~~	() https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A17126 -

Information

Published : 2013-06-26 03:19

Updated : 2024-11-21 01:50

NVD link : CVE-2013-1700

Mitre link : CVE-2013-1700

CVE.ORG link : CVE-2013-1700

JSON object : View

Products Affected

mozilla

firefox

microsoft

windows

CWE

CWE-264

Permissions, Privileges, and Access Controls

{"id": "CVE-2013-1700", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.2, "accessVector": "LOCAL", "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 3.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2013-06-26T03:19:10.963", "references": [{"url": "http://www.mozilla.org/security/announce/2013/mfsa2013-62.html", "tags": ["Vendor Advisory"], "source": "security@mozilla.org"}, {"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=867056", "source": "security@mozilla.org"}, {"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A17126", "source": "security@mozilla.org"}, {"url": "http://www.mozilla.org/security/announce/2013/mfsa2013-62.html", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=867056", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A17126", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-264"}]}], "descriptions": [{"lang": "en", "value": "The Mozilla Maintenance Service in Mozilla Firefox before 22.0 on Windows does not properly handle inability to launch the Mozilla Updater executable file, which allows local users to gain privileges via vectors involving placement of a Trojan horse executable file at an arbitrary location."}, {"lang": "es", "value": "El Mozilla Maintenance Service en Mozilla Firefox anterior a 22.0 sobre Windows no maneja adecuadamente la incapacidad para ejecutar el archivo ejecutable \"Mozilla Updater\", lo que permite a usuarios locales elevar sus privilegios a trav\u00e9s de vectores que permitir\u00edan la disposici\u00f3n de un troyano en una ubicaci\u00f3n arbitraria."}], "lastModified": "2024-11-21T01:50:11.220", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "29071754-CC8F-42D9-82D4-140236802506", "versionEndIncluding": "21.0"}, {"criteria": "cpe:2.3:a:mozilla:firefox:19.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "06FF9DFE-491D-4260-8A49-07FD342B9412"}, {"criteria": "cpe:2.3:a:mozilla:firefox:19.0.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DE09D089-7F48-466B-B03A-C64152A12615"}, {"criteria": "cpe:2.3:a:mozilla:firefox:19.0.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "653D73DA-21C0-4C3F-9269-5A6D5C5B1E34"}, {"criteria": "cpe:2.3:a:mozilla:firefox:20.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "804A0ACE-EB28-413D-93F4-E849FEA01390"}, {"criteria": "cpe:2.3:a:mozilla:firefox:20.0.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3BA49C6F-9115-41A5-BBDE-743CB9DEDDA8"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:microsoft:windows:*:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "2CF61F35-5905-4BA9-AD7E-7DB261D2F256"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "security@mozilla.org"}