Free and open-source vulnerability scanner

Mageni eases for you the vulnerability scanning, assessment, and management process. It is free and open-source.

Install Now

Available for macOS, Windows, and Linux

App screenshot

Mozilla Firefox Security Advisory (MFSA2015-44) - Linux

Information

Severity

Severity

Medium

Family

Family

General

CVSSv2 Base

CVSSv2 Base

4.3

CVSSv2 Vector

CVSSv2 Vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Solution Type

Solution Type

Vendor Patch

Created

Created

2 years ago

Modified

Modified

2 years ago

Summary

This host is missing a security update for Mozilla Firefox.

Insight

Insight

Certificate verification bypass through the HTTP/2 Alt-Svc header Security researcher Muneaki Nishimura discovered a flaw in the Mozilla's HTTP Alternative Services implementation. If an Alt-Svc header is specified in the HTTP/2 response, SSL certificate verification can be bypassed for the specified alternate server. As a result of this, warnings of invalid SSL certificates will not be displayed and an attacker could potentially impersonate another site through a man-in-the-middle (MTIM), replacing the original certificate with their own.

Affected Software

Affected Software

Firefox version(s) below 37.0.1.

Detection Method

Detection Method

Checks if a vulnerable package version is present on the target host.

Solution

Solution

The vendor has released an update. Please see the reference(s) for more information.

Common Vulnerabilities and Exposures (CVE)