CVE-2015-0799

What it actually does

The flaw permits an attacker-controlled Alt-Svc HTTP/2 header to specify a uri-host that bypasses the browser's intended X.509 certificate validation for subsequent TLS connections.

Why it matters to the business

Organizations relying on older Firefox deployments face elevated risk of traffic interception or unauthorized server connections, increasing exposure during routine web browsing and potentially violating data-protection obligations.

How an attack unfolds

An on-path attacker intercepts a victim's HTTP/2 response, injects a crafted Alt-Svc header naming an attacker-controlled or unverified host, and the browser then establishes a TLS session to that host without performing certificate verification, allowing the attacker to read or modify traffic.

How to fix it

Upgrade Mozilla Firefox to version 37.0.1 or later on all affected systems; apply vendor patches for Ubuntu and openSUSE packages that bundle Firefox; disable HTTP/2 Alternative Services via about:config where upgrades are delayed.

How to confirm the fix worked

Confirm Firefox version is 37.0.1 or newer; review enterprise browser deployment manifests and package repositories for the corrected builds; test that Alt-Svc headers no longer suppress certificate validation in controlled lab traffic.

Typical attack path

1. Position as network adversary to observe or modify HTTP/2 traffic
2. Inject malicious Alt-Svc header pointing to attacker-chosen uri-host
3. Victim browser accepts header and initiates TLS connection without certificate check
4. Attacker completes TLS handshake with forged or absent certificate and proceeds with interception

How to detect it

Review proxy or network logs for unusual Alt-Svc response headers containing unexpected uri-host values; examine browser process execution and update history for versions prior to 37.0.1; correlate any observed TLS connections that skipped standard certificate validation.

What your security team should do

• Prioritize immediate upgrade of all Firefox instances to 37.0.1+ given the certificate-bypass impact
• Inventory remaining legacy deployments and apply configuration mitigations until patches are installed
• Monitor browser telemetry and update channels for continued presence of vulnerable versions