Mozilla fixes man-in-the-middle vulnerability in Firefox

Mozilla releases an update to Firefox on September 20 that fixes a man-in-the-middle vulnerability. The vulnerability affects add-on users and was patched Friday with the Tor browser, which is based on Firefox and uses add-ons such as Noscript.

The vulnerability in the Firefox and Tor browsers came to light last week through a posting by security researcher Ryan Duff on the Daily Dave-Seclist. The problem is with the add-on update method. Mozilla uses https connections to automatically update the add-ons via addons.mozilla.org and additionally uses certificate pinning to protect against misuse.

Attackers could use unauthorized digital certificates to make it appear that the updating is going through Mozilla’s servers and thus spread malicious updates to the extensions. Certificate pinning should protect against this, but there was a bug in the way Mozilla updated Preloaded Public Key Pinning, causing certificate pinning to stop working for Firefox 48 as of September 10 and for ESR 45.3.0 as of September 3.

Circumvention would still require a digital certificate, and Mozilla doesn’t know if such certificates are in circulation, but the organization says it’s a concern, particularly for Tor users seeking protection from state-sponsored attacks.

The Tor Project itself already released an update to version 6.0.5 of the browser last Friday, Mozilla will follow on Tuesday with an update of the stable version of Firefox.