CVE-2018-12385

What it actually does

The flaw allows a crash in TransportSecurityInfo during SSL operations when invalid or attacker-controlled data is present in the local profile cache; the crash is potentially exploitable only when combined with a separate write primitive into that cache or with local malware.

Why it matters to the business

Unpatched systems may experience unexpected browser or mail-client crashes that interrupt user work and, in the presence of additional local compromise, could allow code execution; organizations running older Firefox, ESR or Thunderbird releases face prolonged exposure because the issue has been public for years with no observed in-the-wild exploitation.

How an attack unfolds

An attacker must first obtain the ability to write arbitrary data into the Firefox/Thunderbird profile cache (via another vulnerability or by installing malware on the system). Once the malicious cache entry is in place, the browser or mail client processes the TransportSecurityInfo record on the next SSL operation and crashes in a manner that could be turned into arbitrary code execution.

How to fix it

Upgrade Mozilla Firefox to version 62.0.2 or later, Firefox ESR to 60.2.1 or later, and Thunderbird to 60.2.1 or later. After upgrading, clear any affected user profiles that were used with the vulnerable versions to remove potentially malicious cache entries.

How to confirm the fix worked

Verify that the installed Firefox, ESR or Thunderbird version is at or above the fixed releases listed above; inspect profile directories for unexpected TransportSecurityInfo files and confirm that the application starts and performs SSL operations without crashing.

Typical attack path

1. Gain write access to the user's profile cache directory through a separate vulnerability or local malware
2. Place a crafted TransportSecurityInfo record into the cache
3. Trigger an SSL connection that causes the application to read and process the cached record
4. Exploit the resulting crash to execute attacker-controlled code

How to detect it

Review application crash logs and profile directories for unexpected TransportSecurityInfo entries; monitor for repeated startup or SSL-related crashes on systems that have recently switched between release channels or that show signs of local malware.

What your security team should do

• Immediately deploy the fixed Mozilla releases to all endpoints still running vulnerable versions
• Scan enterprise systems for any remaining installations older than Firefox 62.0.2 / ESR 60.2.1 / Thunderbird 60.2.1
• Educate users not to share profiles between Nightly and Release channels