Threat Level: green Handler on Duty: Didier Stevens

SANS ISC: Unpatched Vulnerability in Firefox used to Attack Tor Browser - SANS Internet Storm Center SANS ISC InfoSec Forums

Participate: Learn more about our honeypot network

Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!
Unpatched Vulnerability in Firefox used to Attack Tor Browser

Update: Mozilla now released Firefox 50.0.2 to fix this issue, and the tor project released the corresponding tor browser 6.0.7.

"Tor Browser," an easy to use package of Firefox and Tor is currently being attacked using a so far unpatched vulnerability. The Javascript-based exploit was first described on the Tor mailing list [1]. With the exploit being public now, it is likely only a matter of time to see this exploit used against Firefox outside of Tor.

Mozilla is working on a patch. And Tor Browser 6.0.7 which will hopefully be released later today is scheduled to include the fix. 

Until then: Best not to use Firefox if you can help it. The current version of Firefox, 50.0.1, which was released on Monday, is still vulnerable. While the exploit hasn't been spotted yet outside of Tor, expect it to show up by the time you read this.

An analysis of the shell code used in the exploit by "Wack0" concluded that the code is very similar to an exploit used by law enforcement in 2013 against an older version of Firefox/Tor Browser. [2]



Johannes B. Ullrich, Ph.D.

I will be teaching next: Application Security: Securing Web Apps, APIs, and Microservices - SANS London June 2022


4478 Posts
ISC Handler
Nov 30th 2016

Sign Up for Free or Log In to start participating in the conversation!