Mozilla Foundation Security Advisory 2015-12

Invoking Mozilla updater will load locally stored DLL files

Announced
February 24, 2015
Reporter
Holger Fuhrmannek
Impact
High
Products
Firefox, Firefox ESR, SeaMonkey, Thunderbird
Fixed in
  • Firefox 36
  • Firefox ESR 31.5
  • SeaMonkey 2.33
  • Thunderbird 31.5

Description

Security researcher Holger Fuhrmannek reported that when the Mozilla updater is run directly, the updater will load binary DLL format files from the local working directory or from the Windows temporary directories. This occurs when it is run without the Mozilla Maintenance Service on Windows systems. This allowed for possibly malicious DLL files to execute with elevated privileges if a user agrees when a User Account Control (UAC) prompt from Windows is displayed.

This issue is specific to Windows and does not affect Linux or OS X systems.

References