Vulnerability Name:

CVE-2014-1520 (CCN-92849)

Assigned:2014-04-29
Published:2014-04-29
Updated:2021-03-17
Summary:maintenservice_installer.exe in the Maintenance Service Installer in Mozilla Firefox before 29.0 and Firefox ESR 24.x before 24.5 on Windows allows local users to gain privileges by placing a Trojan horse DLL file into a temporary directory at an unspecified point in the update process.
CVSS v3 Severity:9.3 Critical (CCN CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)
Exploitability Metrics:Attack Vector (AV): Local
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Changed
Impact Metrics:Confidentiality (C): High
Integrity (I): High
Availibility (A): High
CVSS v2 Severity:6.9 Medium (CVSS v2 Vector: AV:L/AC:M/Au:N/C:C/I:C/A:C)
5.4 Medium (Temporal CVSS v2 Vector: AV:L/AC:M/Au:N/C:C/I:C/A:C/E:POC/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Local
Access Complexity (AC): Medium
Authentication (Au): None
Impact Metrics:Confidentiality (C): Complete
Integrity (I): Complete
Availibility (A): Complete
7.2 High (CCN CVSS v2 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C)
5.6 Medium (CCN Temporal CVSS v2 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C/E:POC/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Local
Access Complexity (AC): Low
Athentication (Au): None
Impact Metrics:Confidentiality (C): Complete
Integrity (I): Complete
Availibility (A): Complete
Vulnerability Type:CWE-269
Vulnerability Consequences:Gain Privileges
References:Source: MITRE
Type: CNA
CVE-2014-1520

Source: FEDORA
Type: Third Party Advisory
FEDORA-2014-5833

Source: FEDORA
Type: Third Party Advisory
FEDORA-2014-5829

Source: MISC
Type: Third Party Advisory, VDB Entry
http://packetstormsecurity.com/files/161696/Mozilla-Arbitrary-Code-Execution-Privilege-Escalation.html

Source: FULLDISC
Type: Mailing List, Third Party Advisory
20210308 Unholy CRAP: Moziila's executable installers

Source: SECUNIA
Type: Third Party Advisory
59866

Source: CCN
Type: MFSA 2014-35
Privilege escalation through Mozilla Maintenance Service Installer

Source: CONFIRM
Type: Vendor Advisory
http://www.mozilla.org/security/announce/2014/mfsa2014-35.html

Source: CONFIRM
Type: Third Party Advisory
http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html

Source: CCN
Type: BID-67126
Mozilla Firefox CVE-2014-1520 Local Privilege Escalation Vulnerability

Source: SECTRACK
Type: Third Party Advisory, VDB Entry
1030163

Source: CONFIRM
Type: Exploit, Issue Tracking, Patch, Vendor Advisory
https://bugzilla.mozilla.org/show_bug.cgi?id=961676

Source: XF
Type: UNKNOWN
mozilla-cve20141520-priv-esc(92849)

Source: CCN
Type: Packet Storm Security [06-15-2016]
Mozilla Firefox DLL Hijacking

Source: GENTOO
Type: Third Party Advisory
GLSA-201504-01

Vulnerable Configuration:Configuration 1:
  • cpe:/a:mozilla:firefox:*:*:*:*:*:*:*:* (Version < 29.0)
  • OR cpe:/a:mozilla:firefox_esr:*:*:*:*:*:*:*:* (Version >= 24.0 and < 24.5)
  • AND
  • cpe:/o:microsoft:windows:*:*:*:*:*:*:*:*

    • Configuration 2:
  • cpe:/o:fedoraproject:fedora:19:*:*:*:*:*:*:*
  • OR cpe:/o:fedoraproject:fedora:20:*:*:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/a:mozilla:firefox:28.0:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:firefox_esr:24.4:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.opensuse.security:def:20141520
    V
    		CVE-2014-1520
    2022-05-20
    oval:org.opensuse.security:def:33795
    P
    		Security update for apache2 (Important)
    2022-01-12
    oval:org.opensuse.security:def:29464
    P
    		Security update for chrony (Moderate)
    2021-12-22
    oval:org.opensuse.security:def:33993
    P
    		Security update for tomcat (Important)
    2021-11-03
    oval:org.opensuse.security:def:55264
    P
    		Security update for binutils (Moderate)
    2021-11-02
    oval:org.opensuse.security:def:33732
    P
    		Security update for opensc (Important)
    2021-10-29
    oval:org.opensuse.security:def:33729
    P
    		Security update for MozillaFirefox (Important)
    2021-10-15
    oval:org.opensuse.security:def:29433
    P
    		Security update for xen (Moderate)
    2021-10-07
    oval:org.opensuse.security:def:33015
    P
    		Security update for atftp (Moderate)
    2021-09-27
    oval:org.opensuse.security:def:33004
    P
    		Security update for transfig (Moderate)
    2021-09-16
    oval:org.opensuse.security:def:33003
    P
    		Security update for postgresql13 (Moderate)
    2021-09-16
    oval:org.opensuse.security:def:55942
    P
    		Security update for aspell (Important)
    2021-08-25
    oval:org.opensuse.security:def:34517
    P
    		Security update for openssl-1_1 (Important)
    2021-08-24
    oval:org.opensuse.security:def:33683
    P
    		Security update for libsolv (Important)
    2021-06-28
    oval:org.opensuse.security:def:33641
    P
    		Security update for permissions (Important)
    2021-04-29
    oval:org.opensuse.security:def:29348
    P
    		Security update for sudo (Important)
    2021-04-20
    oval:org.opensuse.security:def:30052
    P
    		Security update for MozillaFirefox (Important)
    2021-03-31
    oval:org.opensuse.security:def:33094
    P
    		Security update for apache2 (Moderate)
    2021-03-12
    oval:org.opensuse.security:def:55861
    P
    		Security update for git (Important)
    2021-03-09
    oval:org.opensuse.security:def:34032
    P
    		Security update for MozillaFirefox (Important)
    2021-03-01
    oval:org.opensuse.security:def:33771
    P
    		Security update for java-1_8_0-ibm (Important)
    2021-02-26
    oval:org.opensuse.security:def:33944
    P
    		Security update for MozillaFirefox (Important)
    2021-01-29
    oval:org.opensuse.security:def:30008
    P
    		Security update for postgresql, postgresql12, postgresql13 (Important)
    2021-01-26
    oval:org.opensuse.security:def:34477
    P
    		Security update for postgresql, postgresql12, postgresql13 (Important)
    2021-01-26
    oval:org.opensuse.security:def:33886
    P
    		Security update for cyrus-sasl (Important)
    2020-12-28
    oval:org.opensuse.security:def:33626
    P
    		Security update for xen (Moderate)
    2020-12-22
    oval:org.opensuse.security:def:29950
    P
    		Security update for mutt (Important)
    2020-12-07
    oval:org.opensuse.security:def:27191
    P
    		libjasper on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:33381
    P
    		Security update for clamsap (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:29728
    P
    		Security update for MozillaFirefox, firefox-glib2, firefox-gtk3 (Important)
    2020-12-01
    oval:org.opensuse.security:def:34779
    P
    		Security update for Mozilla Firefox
    2020-12-01
    oval:org.opensuse.security:def:27180
    P
    		libecpg6 on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:33324
    P
    		Security update for curl (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:29689
    P
    		Security update for evince (Important)
    2020-12-01
    oval:org.opensuse.security:def:34739
    P
    		Security update for LibVNCServer (Important)
    2020-12-01
    oval:org.opensuse.security:def:27179
    P
    		libdrm on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:33229
    P
    		perl-HTML-Parser on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:29640
    P
    		Security update for cracklib (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:34101
    P
    		Security update for mono-core (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:29586
    P
    		Security update for apache2-mod_nss (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:34057
    P
    		Security update for libvorbis (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:30727
    P
    		Security update for Mozilla Firefox
    2020-12-01
    oval:org.opensuse.security:def:29291
    P
    		Security update for the Linux Kernel (Important)
    2020-12-01
    oval:org.opensuse.security:def:30690
    P
    		Security update for Mesa (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:29205
    P
    		Security update for openssl (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:29074
    P
    		Security update for cups (Important)
    2020-12-01
    oval:org.opensuse.security:def:29005
    P
    		Security update for ctdb (Important)
    2020-12-01
    oval:org.opensuse.security:def:29989
    P
    		Security update for libssh2_org (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:28994
    P
    		Security update for conntrack-tools (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:33584
    P
    		Security update for MozillaFirefox (Important)
    2020-12-01
    oval:org.opensuse.security:def:27699
    P
    		Security update for Mozilla Firefox
    2020-12-01
    oval:org.opensuse.security:def:28993
    P
    		Security update for xscreensaver (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:33488
    P
    		Security update for Python
    2020-12-01
    oval:org.opensuse.security:def:29901
    P
    		Security update for krb5
    2020-12-01
    oval:org.opensuse.security:def:27664
    P
    		Security update for rubygem-actionpack-2_3
    2020-12-01
    oval:org.opensuse.security:def:33353
    P
    		Security update for openssl1 (Important)
    2020-12-01
    oval:org.opensuse.security:def:29846
    P
    		Security update for Linux kernel
    2020-12-01
    oval:org.opensuse.security:def:27026
    P
    		rsyslog on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:33273
    P
    		tftp on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:29693
    P
    		Security update for expat (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:26982
    P
    		libxslt on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:33262
    P
    		stunnel on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:29608
    P
    		Security update for bind (Important)
    2020-12-01
    oval:org.opensuse.security:def:26968
    P
    		librpcsecgss on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:57292
    P
    		Security update for Mozilla Firefox
    2020-12-01
    oval:org.opensuse.security:def:33261
    P
    		strongswan on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:29551
    P
    		Security update for MozillaFirefox (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:26929
    P
    		kdenetwork4-filesharing on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:57218
    P
    		Security update for ghostscript
    2020-12-01
    oval:org.opensuse.security:def:26880
    P
    		cyrus-imapd on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:29333
    P
    		Security update for compat-openssl097g (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:26827
    P
    		sysstat on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:29263
    P
    		Security update for wpa_supplicant (Important)
    2020-12-01
    oval:org.opensuse.security:def:26676
    P
    		cifs-utils on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:55823
    P
    		Security update for gtk2 (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:29252
    P
    		Security update for tar (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:26592
    P
    		libneon27 on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:55749
    P
    		Security update for xscreensaver (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:28629
    P
    		Security update for Mozilla Firefox
    2020-12-01
    oval:org.opensuse.security:def:29251
    P
    		Security update for syslog-ng (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:26535
    P
    		cyrus-imapd on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:55657
    P
    		Security update for rsync (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:28594
    P
    		Security update for Perl
    2020-12-01
    oval:org.opensuse.security:def:26454
    P
    		Security update for python-Jinja2 (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:55549
    P
    		Security update for ruby2.1 (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:27956
    P
    		Security update for ImageMagick (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:26326
    P
    		Security update for MozillaThunderbird (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:27912
    P
    		Security update for Xen
    2020-12-01
    oval:org.opensuse.security:def:26262
    P
    		Security update for the Linux Kernel (Important)
    2020-12-01
    oval:org.opensuse.security:def:55098
    P
    		elfutils on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:27898
    P
    		Security update for wireshark
    2020-12-01
    oval:org.opensuse.security:def:26251
    P
    		Security update for zziplib (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:54992
    P
    		python-cupshelpers on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:27859
    P
    		Security update for postgresql91 (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:26250
    P
    		Security update for the Linux Kernel (Important)
    2020-12-01
    oval:org.opensuse.security:def:54819
    P
    		krb5-appl-clients on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:27810
    P
    		Security update for libqt4
    2020-12-01
    oval:org.opensuse.security:def:33839
    P
    		Security update for graphviz (Low)
    2020-12-01
    oval:org.opensuse.security:def:54581
    P
    		libopenssl0_9_8 on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:27757
    P
    		Security update for glibc (Important)
    2020-12-01
    oval:org.opensuse.security:def:54441
    P
    		cron on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:27606
    P
    		Security update for curl
    2020-12-01
    oval:org.opensuse.security:def:54419
    P
    		aaa_base on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:27522
    P
    		obex-data-server on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:30465
    P
    		Security update for Mozilla Firefox
    2020-12-01
    oval:org.opensuse.security:def:54418
    P
    		NetworkManager on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:27465
    P
    		libneon-devel on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:30428
    P
    		Security update for xorg-x11-libs (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:27383
    P
    		ctdb-devel on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:29790
    P
    		Security update for gtk2 (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:27255
    P
    		opie on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:33469
    P
    		Security update for Kerberos
    2020-12-01
    oval:org.opensuse.security:def:29746
    P
    		Security update for gd
    2020-12-01
    oval:org.mitre.oval:def:25227
    P
    		SUSE-SU-2014:0638-2 -- Security update for Mozilla Firefox
    2015-03-16
    oval:org.mitre.oval:def:25177
    P
    		SUSE-SU-2014:0638-1 -- Security update for Mozilla Firefox
    2015-03-16
    oval:org.mitre.oval:def:24370
    V
    		Privilege escalation through Mozilla Maintenance Service Installer
    2014-10-06
    oval:org.opensuse.security:def:79926
    P
    		Security update for Mozilla Firefox
    2014-05-01
    oval:com.ubuntu.precise:def:20141520000
    V
    		CVE-2014-1520 on Ubuntu 12.04 LTS (precise) - medium.
    2014-04-30
    oval:com.ubuntu.trusty:def:20141520000
    V
    		CVE-2014-1520 on Ubuntu 14.04 LTS (trusty) - medium.
    2014-04-30
    BACK
    mozilla firefox *
    mozilla firefox esr *
    microsoft windows *
    fedoraproject fedora 19
    fedoraproject fedora 20
    mozilla firefox 28.0
    mozilla firefox esr 24.4