CVE-2018-12368 Information

Description

Windows 10 does not warn users before opening executable files with the SettingContent-ms extension even when they have been downloaded from the internet and have the \Mark of the Web.\ Without the warning unsuspecting users unfamiliar with this new file type might run an unwanted executable. This also allows a WebExtension with the limited downloads.open permission to execute arbitrary code without user interaction on Windows 10 systems. Note: this issue only affects Windows operating systems. Other operating systems are unaffected.. This vulnerability affects Thunderbird 60 Thunderbird 52.9 Firefox ESR 60.1 Firefox ESR 52.9 and Firefox 61.

CVSS Vector

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Reference

http://www.securityfocus.com/bid/104560 http://www.securitytracker.com/id/1041193 https://bugzilla.mozilla.org/show_bug.cgi?id=1468217 https://posts.specterops.io/the-tale-of-settingcontent-ms-files-f1ea253e4d39 https://security.gentoo.org/glsa/201810-01 https://www.mozilla.org/security/advisories/mfsa2018-15/ https://www.mozilla.org/security/advisories/mfsa2018-16/ https://www.mozilla.org/security/advisories/mfsa2018-17/ https://www.mozilla.org/security/advisories/mfsa2018-18/ https://www.mozilla.org/security/advisories/mfsa2018-19/

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction Required

NONE

Scope

NONE

Confidentiality Impact

UNCHANGED

Integrity Impact

HIGH

Availability Impact

HIGH

Base Score

HIGH

Base Severity

8.1