Author: Melodie Foster

Date: 12th January 2021

 

Major browsers are urging users to patch critical vulnerabilities which could allow attackers to hijack systems running the software.

The flaw in Firefox is a critical use-after-free bug stemming from how Firefox handles browser cookies. If exploited, it would allow hackers to gain access to the device running Firefox. Mozilla said the issue was that an attacker could have modified a “COOKIE-ECHO” chunk in a SCTP packet which could have resulted in a use-after-free. A COOKIE ECHO chunk is a section of data that is sent during initialisation of the SCTP connection with the browser. This means that the bug is tied to the way the cookie data is handled by SCTP and according to Mozilla means that a hacker could make a malicious COOKIE ECHO chunk which would impact the browser’s memory.

The affected versions include versions prior to Firefox desktop 84.0.2, Firefox Android 84.1.3 and Mozilla’s corporate ESR 78.6.1.

Google Chrome users are being urged to patch an out-of-bounds write bug found in V8 which is Google’s open-source JavaScript and WebAssembly engine. The technical details of this bug are not available.

Since the bug was originally found in September 2020 and was first mentioned in a security bulletin in October 2020, this could be an indication that the fix issued in October was incomplete.

It is therefore advised to update to the latest version of the Chrome browser.[1]

[1] https://threatpost.com/firefox-chrome-edge-bugs-system-hijacking/162873/

 

Other resources

Cyberfort Colocation Services

Cyberfort has invested heavily in secure infrastructure, making us the perfect colocation service provider to host your mission-critical, sensitive and regulated data.
Find out more >

What can Cyberfort do for you?

Check out our factsheets for detailed information on the matrix of cybersecurity products and services we offer to protect your business.
Find out more >

Cyberfort Deep Dives

Cyberfort’s cybersecurity consultants explore issues in cyber threat intelligence, incident planning and data security. Read our whitepapers to help make decisions that benefit your business.
Find out more >