Firefox PDF viewer exploit used to access local files [Already Patched]

[burnttoastnice]

A bug was discovered which allows a remote attacker to gain access to a local user's filesystem through an exploit in Firefox's PDF.js viewer. This bug is being actively exploited in Russia, where malicious advertisements use the PDF.js local context to look for password credential files and upload them to a server. It is thought that this attack is mainly aimed at developers.

 

 

The malware that took advantage of the bug in Firefox's Javascript-based PDF reader was being deployed through ads that appeared on a Russian news site. The malware would search for sensitive files on people's PCs and then upload them to a server in Ukraine.

As the vulnerability only affects Firefox's PDF.js reader, that means only the desktop version of Firefox is affected by it, but not the Android version. According to Mozilla, the vulnerability doesn't enable the execution of arbitrary code, but the exploit was able to inject a Javascript payload into the local file context that allowed it to search for local files.

The somewhat good news here is that the exploit seems to have targeted mainly developers, despite being deployed on a major Russian news site. For instance, on Windows it looked for the configuration files of various FTP clients, including Filezilla. On Linux, it targeted configuration files such as /etc/passwd, .bash_history, .mysql_history, .pgsql_history, and .ssh. Mac users were not targeted by this exploit, but they would not be immune to a different payload utilizing the same Firefox vulnerability.

 

Sauce: http://www.tomshardware.co.uk/firefox-security-vulnerability-upgrade-patch,news-50953.html

 

I use Firefox for development myself and only visit a few websites on it (Mainly just LTT, The Verge and a few other well-reputable sites). If you're a developer and you've visited a russian news site recently, I'd strongly advise changing your passwords etc. I use a web IDE to work on my own site, and there doesn't appear to be too much information regarding whether the exploit extracts passwords from your Firefox profile.

 

TL;DR - Go into your Firefox settings right NOW and set a master password - it will encrypt all your other saved passwords.

 

Edit

@Syntaxvgm pointed out that as long as you are on version 39.0.3 you are good.

 

Just to note:
Alt>Help>Version
39.0.3 and you are good

[Syntaxvgm]

Just to note:

Alt>Help>Version

39.0.3 and you are good