CVE-2019-11707, CVE-2019-11708: Multiple Zero-Day Vulnerabilities in Mozilla Firefox Exploited in the Wild

Satnam Narang

Security researchers discover two zero-day vulnerabilities in Mozilla Firefox used in targeted attacks.

Editor’s Note: This blog was updated on June 20 to reflect additional information regarding a second vulnerability used in combination with CVE-2019-11707, as well as security updates from Mozilla. 

Background

On June 18 and June 20, the Mozilla Foundation published security advisories [1, 2] to address two zero-day vulnerabilities in Mozilla Firefox being used in targeted attacks in the wild.

Analysis

According to the first security advisory, CVE-2019-11707 is a type confusion vulnerability in Mozilla Firefox that can result in an exploitable crash due to issues in Array.pop which can occur when manipulating JavaScript objects. In the second security advisory, CVE-2019-11708 is a sandbox escape vulnerability in Prompt:Open Inter-process communication (IPC) messages due to insufficient vetting of parameters. An attacker could exploit this vulnerability to cause a non-sandboxed parent process to open web content from a compromised child process using a specially crafted Prompt:Open IPC message between the child and parent process. Combining both CVE-2019-11708 and CVE-2019-11707 can result in arbitrary code execution.

The vulnerabilities were reported to Mozilla by Google Project Zero’s Samuel Groß and the Coinbase Security team. 

Samuel Groß provided additional context about the vulnerability in Tweets posted on June 19. Groß mentions he did not have details about the active exploitation in the wild and that he reported the bug back in April. He noted that while remote code execution (RCE) is possible, it would “need a separate sandbox escape.” Finally, he did mention that on its own, the vulnerability “can also be exploited for Universal Cross-Site Scripting (UXSS) which might be enough depending on the attacker’s goals.”

Philip Martin, Chief Information Security Officer (CISO) at Coinbase, published a series of Tweets on June 20 providing additional context around the targeted attack. According to Martin, CVE-2019-11707 was used in conjunction with a separate Firefox zero-day sandbox escape vulnerability (CVE-2019-11708) to target Coinbase employees. Martin added that Coinbase wasn’t the only “crypto org” targeted in this attack campaign and his team has provided indicators of compromise (IOCs) to assist other organizations. 

Additionally, Patrick Wardle, Founder and Chief Research Officer (CRO) for Digita Security, published a blog analyzing a macOS malware sample sent to him that matches one of the malicious files referenced by Philip Martin in his Tweets.

Solution

Mozilla released Firefox 67.0.3 and Firefox Extended Support Release (ESR) 60.7.1 on June 18 to address CVE-2019-11707 and released Firefox 67.0.4 and Firefox ESR 60.7.2 on June 20 to address CVE-2019-11708. Users are advised to upgrade to the latest versions of Firefox as soon as possible.

Identifying affected systems

A list of Tenable plugins to identify these vulnerabilities will appear here as they’re released.

Get more information

Join Tenable's Security Response Team on the Tenable Community.

Learn more about Tenable, the first Cyber Exposure platform for holistic management of your modern attack surface. Get a free 60-day trial of Tenable.io.

Read more >

Published on Jun 18, 2019

People also viewed

Business Cost Analyst - Cloud Infrastructure

San Jose California United States E Santa Clara St., San Jose, California, United States, 95113 Engineering Engineering
Your Role:Tenable is seeking a Business Cost Analyst of Cloud Infrastructure with strong MS Excel experience to assess, analyze and compile current costs and potentially determine initiatives to reduce and improve our cloud infrastructure cost for...

Professional Services Engagement Manager

Singapore Singapore Singapore North Bridge Road, Parkview Square, Singapore, 188788 Professional Services Professional Services
Your Role:The Professional Services Engagement Manager assists in the professional services business development and oversees the delivery of projects. The Professional Services Engagement Manager’s roles include tactical project management oversi...

UX Designer

Columbia Maryland United States Columbia Gateway Drive, Columbia, Maryland, United States, 21046 Engineering Engineering
Your Role:Tenable is looking for an extraordinary Senior UX Designer to join our team. Our group is chartered with creating the next generation of security products while at the same time pioneering unprecedented user experience in the digital sec...

Commercial Territory Manager - West

Columbia Maryland United States Columbia Gateway Drive, Columbia, Maryland, United States, 21046 Sales Sales
Your Role:The Commercial Territory Manager will meet and exceed quarterly sales quota by developing new opportunities within specific geographical territory.  Researching and identifying potential accounts; outbound cold calling to soliciting new ...

Senior Software Engineer (Java & Kotlin)

San Jose California United States E Santa Clara St., San Jose, California, United States, 95113 Engineering Engineering
Your Role:Tenable is looking for a Senior Software Engineer to join the Lumin product development team. As a Sr. Software Engineer you will drive projects end-to-end, collaborate on product requirements with Product Managers, architect and impleme...

Public Sector Channel Manager - Distribution

Reston Virginia United States Reston, Virginia, United States Channel Sales Sales
Your Role:The Public Sector Channel Manager-Distribution is responsible for establishing and managing relationships with the Distribution Partner(s).  The CM-Disty will act as a sales liaison between distributor and Tenable Channel Manager personn...

We have big plans for continued global growth, and we’re looking for people who are creative, flexible and dedicated to helping us build something great – something that matters.