^{CVE-2017-5408:}Cross-Origin Resource Sharing (CORS) Bypass in Mozilla Products Allows Information Disclosure of Video Captions

Overview

CVE-2017-5408 is a security vulnerability classified as CWE-200 (Information Disclosure) affecting Mozilla's Firefox browser and Thunderbird email client. The issue stems from improper implementation of Cross-Origin Resource Sharing (CORS) controls when handling video captions. When video files load captions, the application fails to check for appropriate CORS headers that would normally restrict cross-origin access. This vulnerability could allow malicious websites to access video caption content from other domains without proper authorization, potentially leading to information leakage. The vulnerability affects Firefox versions prior to 52, Firefox ESR versions prior to 45.8, and Thunderbird versions prior to 52 and 45.8.

Remediation

Users and administrators should update their Mozilla products to the following versions or newer:

• Firefox: Update to version 52 or later
• Firefox ESR: Update to version 45.8 or later
• Thunderbird: Update to version 52 or later (or 45.8 if using the ESR branch)

System administrators should ensure that all instances of these applications are updated across their environments. The updates can be obtained through the standard update mechanisms or by downloading the latest versions from the Mozilla website. For enterprise deployments, consider using centralized update management systems to ensure all instances are patched.

References

1. Mozilla Foundation Security Advisories:

   • MFSA2017-05: https://www.mozilla.org/security/advisories/mfsa2017-05/
   • MFSA2017-06: https://www.mozilla.org/security/advisories/mfsa2017-06/
   • MFSA2017-07: https://www.mozilla.org/security/advisories/mfsa2017-07/
   • MFSA2017-09: https://www.mozilla.org/security/advisories/mfsa2017-09/

2. Mozilla Bug Tracker:

   • https://bugzilla.mozilla.org/show_bug.cgi?id=1313711

3. Distribution-specific advisories:

   • Red Hat: RHSA-2017:0459, RHSA-2017:0461, RHSA-2017:0498
   • Debian: DSA-3805, DSA-3832
   • Gentoo: GLSA-201705-06, GLSA-201705-07

4. Third-party references:

   • SecurityFocus: BID-96693
   • SecurityTracker: ID-1037966