CVE-2019-11748 : Security Advisory and Response
Learn about CVE-2019-11748 affecting Firefox and Firefox ESR versions prior to 69 and 68.1. Understand the impact, exploitation mechanism, and mitigation steps.
WebRTC in Firefox and Firefox ESR versions prior to 69 and 68.1 respectively, has a vulnerability that could allow trusted WebRTC resources to be embedded in web content without user permission.
Understanding CVE-2019-11748
This CVE involves the persistence of WebRTC permissions in a third-party context, impacting Firefox and Firefox ESR.
What is CVE-2019-11748?
In Firefox and Firefox ESR, WebRTC permissions granted by users to websites for accessing microphone and camera resources are no longer preserved due to recent security issues in other software. This prevents the risk of trusted WebRTC resources being secretly embedded in web content and misusing previously granted permissions.
The Impact of CVE-2019-11748
The vulnerability affects Firefox versions prior to 69 and Firefox ESR versions prior to 68.1. Users will now be prompted for permissions each time they want to use microphone and camera resources.
Technical Details of CVE-2019-11748
WebRTC permissions are not persisted in a third-party context, enhancing user security.
Vulnerability Description
WebRTC in Firefox and Firefox ESR will no longer honor persisted permissions for microphone and camera resources in a third-party context.
Affected Systems and Versions
- Firefox versions prior to 69
- Firefox ESR versions prior to 68.1
Exploitation Mechanism
Trusted WebRTC resources could be embedded in web content without user consent, potentially leading to misuse of permissions.
Mitigation and Prevention
To address CVE-2019-11748, users and organizations should take immediate and long-term security measures.
Immediate Steps to Take
- Update Firefox and Firefox ESR to versions 69 and 68.1 respectively.
- Be cautious when granting permissions to websites for microphone and camera access.
Long-Term Security Practices
- Regularly review and adjust browser permissions for enhanced security.
- Educate users on the importance of granting permissions only to trusted websites.
Patching and Updates
- Stay informed about security advisories and updates from Mozilla to address vulnerabilities like CVE-2019-11748.