CVE-2020-15667
📋 TL;DR
This vulnerability allows arbitrary code execution through a heap overflow when processing malicious MAR update files with invalid name lengths. It affects Firefox versions before 80. Exploitation requires Mozilla's signing key, limiting real-world attack vectors.
💻 Affected Systems
- Mozilla Firefox
📦 What is this software?
Firefox by Mozilla
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise via arbitrary code execution with the privileges of the Firefox process.
Likely Case
Limited exploitation due to requirement for Mozilla signing key; potential targeted attacks if key is compromised.
If Mitigated
No impact if Firefox is updated to version 80+ or if MAR updates are disabled.
🎯 Exploit Status
Requires Mozilla signing key and specific MAR file manipulation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Firefox 80
Vendor Advisory: https://www.mozilla.org/security/advisories/mfsa2020-36/
Restart Required: Yes
Instructions:
1. Open Firefox. 2. Click menu → Help → About Firefox. 3. Allow automatic update to version 80 or higher. 4. Restart Firefox when prompted.
🔧 Temporary Workarounds
Disable MAR updates
allPrevents processing of MAR update files entirely
Set app.update.marEnabled to false in about:config
🧯 If You Can't Patch
- Disable MAR updates via about:config
- Restrict Firefox from downloading/processing external MAR files
🔍 How to Verify
Check if Vulnerable:
Check Firefox version via about:support or Help → About Firefox. If version is less than 80, system is vulnerable.Check Version:
firefox --versionVerify Fix Applied:
Confirm Firefox version is 80 or higher via about:support.📡 Detection & Monitoring
Log Indicators:
- Failed MAR update attempts
- Firefox crash reports with memory corruption signatures
Network Indicators:
- Downloads of MAR files from unusual sources
SIEM Query:
source="firefox.log" AND ("MAR" OR "update" OR "heap overflow")