Author: Melodie Foster
Date: 12th January 2021
Major browsers are urging users to patch critical vulnerabilities which could allow attackers to hijack systems running the software.
The flaw in Firefox is a critical use-after-free bug stemming from how Firefox handles browser cookies. If exploited, it would allow hackers to gain access to the device running Firefox. Mozilla said the issue was that an attacker could have modified a “COOKIE-ECHO” chunk in a SCTP packet which could have resulted in a use-after-free. A COOKIE ECHO chunk is a section of data that is sent during initialisation of the SCTP connection with the browser. This means that the bug is tied to the way the cookie data is handled by SCTP and according to Mozilla means that a hacker could make a malicious COOKIE ECHO chunk which would impact the browser’s memory.
The affected versions include versions prior to Firefox desktop 84.0.2, Firefox Android 84.1.3 and Mozilla’s corporate ESR 78.6.1.
Since the bug was originally found in September 2020 and was first mentioned in a security bulletin in October 2020, this could be an indication that the fix issued in October was incomplete.
It is therefore advised to update to the latest version of the Chrome browser.
Cyberfort Colocation Services
Cyberfort has invested heavily in secure infrastructure, making us the perfect colocation service provider to host your mission-critical, sensitive and regulated data.
Find out more >
Cyberfort Deep Dives
Cyberfort’s cybersecurity consultants explore issues in cyber threat intelligence, incident planning and data security. Read our whitepapers to help make decisions that benefit your business.
Find out more >