Mozilla FireFox Security Technical Implementation Guide
V001.006R1 2019-12-12       U_MOZ_Firefox_RHEL_V1R6_STIG_SCAP_1-2_Benchmark.xml
The Mozilla FireFox Security Technical Implementation Guide (STIG) is published as a tool to improve the security of Department of Defense (DoD) information systems. Comments or proposed revisions to this document should be sent via e-mail to the following address: [email protected]
Vuln Rule Version CCI Severity Title Description
SV-16707r1_rule DTBF050 CCI-001274 MEDIUM FireFox is configured to ask which certificate to present to a web site when a certificate is required. When a web site asks for a certificate for user authentication, Firefox must be configured to have the user choose which certificate to present. Websites within DOD require user authentication for access which increases security for DoD information. Access will be denied to the user if certificate management is not configured.System Administrator
SV-16710r3_rule DTBF105 CCI-000381 MEDIUM Network shell protocol is enabled in FireFox. Although current versions of Firefox have this set to disabled by default, use of this option can be harmful. This would allow the browser to access the Windows shell. This could allow access to the underlying system. This check verifies that the default setting has not been changed. System Administrator
SV-16711r4_rule DTBF110 CCI-001243 MEDIUM Firefox is not configured to prompt a user before downloading and opening required file types. New file types cannot be added directly to the helper applications or plugins listing. Files with these extensions will not be allowed to use Firefox publicly available plugins and extensions to open. The application will be configured to open these files using external applications only. After a helper application or save to disk download action has been set, that action will be taken automatically for those types of files. When the user receives a dialog box asking if you want to save the file or open it with a specified application, this indicates that a plugin does not exist. The user has not previously selected a download action or helper application to automatically use for that type of file. When prompted, if the user checks the option to Do this automatically for files like this from now on, then an entry will appear for that type of file in the plugins listing and this file type is automatically opened in the future. This can be a security issue. New file types cannot be added directly to the Application plugin listing. System Administrator
SV-16713r2_rule DTBF140 CCI-000381 MEDIUM Firefox formfill assistance option is disabled. In order to protect privacy and sensitive data, Firefox provides the ability to configure Firefox such that data entered into forms is not saved. This mitigates the risk of a website gleaning private information from prefilled information.System Administrator
SV-16714r3_rule DTBF150 CCI-000381 MEDIUM Firefox is configured to autofill passwords. While on the internet, it may be possible for an attacker to view the saved password files and gain access to the user's accounts on various hosts. System Administrator
SV-16715r2_rule DTBF160 CCI-000381 MEDIUM FireFox is configured to use a password store with or without a master password. Firefox can be set to store passwords for sites visited by the user. These individual passwords are stored in a file and can be protected by a master password. Autofill of the password can then be enabled when the site is visited. This feature could also be used to autofill the certificate pin which could lead to compromise of DoD information.System Administrator
SV-16717r1_rule DTBF180 CCI-000381 MEDIUM FireFox is not configured to block pop-up windows. Popup windows may be used to launch an attack within a new browser window with altered settings. This setting blocks popup windows created while the page is loading.System Administrator
SV-16718r1_rule DTBF181 CCI-000381 MEDIUM FireFox is configured to allow JavaScript to move or resize windows. JavaScript can make changes to the browser’s appearance. This activity can help disguise an attack taking place in a minimized background window. Set browser setting to prevent scripts on visited websites from moving and resizing browser windows. System Administrator
SV-16925r8_rule DTBF030 CCI-002450 MEDIUM Firefox must be configured to allow only TLS. Use of versions prior to TLS 1.1 are not permitted. SSL 2.0 and SSL 3.0 contain a number of security flaws. These versions must be disabled in compliance with the Network Infrastructure and Secure Remote Computing STIGs.System Administrator
SV-16927r1_rule DTBF182 CCI-000381 MEDIUM Firefox is configured to allow JavaScript to raise or lower windows. JavaScript can make changes to the browser’s appearance. Allowing a website to use JavaScript to raise and lower browser windows may disguise an attack. Browser windows may not be set as active via JavaScript. System Administrator
SV-16928r2_rule DTBF183 CCI-000381 MEDIUM Firefox is configured to allow JavaScript to disable or replace context menus. A context menu (also known as a pop-up menu) is often used in a graphical user interface (GUI) and appears upon user interaction (e.g., a right mouse click). A context menu offers a limited set of choices that are available in the current state, or context, of the operating system or application. A website may execute JavaScript that can make changes to these context menus. This can help disguise an attack. Set this preference to "false" so that webpages will not be able to affect the context menu event.System Administrator
SV-59603r1_rule DTBF090 CCI-000381 MEDIUM Firefox automatically updates installed add-ons and plugins. Set this to false to disable checking for updated versions of the Extensions/Themes. Automatic updates from untrusted sites puts the enclave at risk of attack and may override security settings.System Administrator
SV-21889r9_rule DTBF070 CCI-000366 MEDIUM Firefox required security preferences cannot be changed by user. Locked settings prevent users from accessing about:config and changing the security settings set by the system administrator. Locked settings should be placed in the mozilla.cfg file. The mozilla.cfg file is an encoded file of JavaScript commands. The encoding is a simple "byte-shifting" with an offset of 13 (Netscape 4 used a similar encoding, but with a 7 instead). This file also needs to be "called" from the configuration file local-settings.jsSystem Administrator
SV-21890r1_rule DTBF085 CCI-000381 MEDIUM Firefox automatically checks for updated version of installed Search plugins. Updates need to be controlled and installed from authorized and trusted servers. This setting overrides a number of other settings which may direct the application to access external URLs.System AdministratorECSC-1
SV-79381r3_rule DTBF186 CCI-000381 MEDIUM Extensions install must be disabled. A browser extension is a program that has been installed into the browser which adds functionality to it. Where a plug-in interacts only with a web page and usually a third party external application (Flash, Adobe Reader) an extension interacts with the browser program itself. Extensions are not embedded in web pages and must be downloaded and installed in order to work. Extensions allow browsers to avoid restrictions which apply to web pages. For example, an extension can be written to combine data from multiple domains and present it when a certain page is accessed which can be considered Cross Site Scripting. If a browser is configured to allow unrestricted use of extension then plug-ins can be loaded and installed from malicious sources and used on the browser.System Administrator
SV-93759r3_rule DTBF190 CCI-000381 MEDIUM Background submission of information to Mozilla must be disabled. There should be no background submission of technical and other information from DoD computers to Mozilla with portions posted publically.