CVE-2024-11706
📋 TL;DR
A null pointer dereference vulnerability in pk12util's SEC_ASN1DecodeItem_Util function allows attackers to cause denial of service by crashing applications when processing malformed input files. This affects Firefox and Thunderbird users running versions below 133. The vulnerability requires user interaction to open malicious files.
💻 Affected Systems
- Mozilla Firefox
- Mozilla Thunderbird
📦 What is this software?
Firefox by Mozilla
Thunderbird by Mozilla
⚠️ Risk & Real-World Impact
Worst Case
Application crash leading to denial of service, potentially causing data loss if unsaved work is open
Likely Case
Application crash when processing malicious PKCS#12 files, requiring user to restart the affected program
If Mitigated
No impact if users avoid opening untrusted PKCS#12 files or have updated to patched versions
🎯 Exploit Status
Requires user to open malicious PKCS#12 file; no known active exploitation
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Firefox 133, Thunderbird 133
Vendor Advisory: https://www.mozilla.org/security/advisories/mfsa2024-63/
Restart Required: Yes
Instructions:
1. Open Firefox/Thunderbird. 2. Click menu → Help → About Firefox/Thunderbird. 3. Allow automatic update to version 133 or higher. 4. Restart the application when prompted.
🔧 Temporary Workarounds
Disable PKCS#12 file handling
allPrevent applications from processing PKCS#12 files
Not applicable - configuration change only
User education
allTrain users to avoid opening untrusted PKCS#12 files
🧯 If You Can't Patch
- Implement application whitelisting to block execution of vulnerable Firefox/Thunderbird versions
- Use endpoint protection to detect and block malicious PKCS#12 files
🔍 How to Verify
Check if Vulnerable:
Check Firefox/Thunderbird version: Firefox → Help → About Firefox; Thunderbird → Help → About ThunderbirdCheck Version:
firefox --version (Linux) or check About dialog (Windows/macOS)Verify Fix Applied:
Confirm version is 133 or higher in About dialog📡 Detection & Monitoring
Log Indicators:
- Application crash logs mentioning pk12util or SEC_ASN1DecodeItem_Util
- Unexpected termination of Firefox/Thunderbird processes
Network Indicators:
- Download of PKCS#12 files (.p12, .pfx) from untrusted sources
SIEM Query:
EventID=1000 OR EventID=1001 AND ProcessName="firefox.exe" OR ProcessName="thunderbird.exe" AND ExceptionCode=0xC0000005