0 day attack on Firefox users stole password and key data. Patch now

A website in Russia has been caught exploiting a serious zero-day vulnerability in Mozillas Firefox browser, prompting the open-source developer to deliver an emergency update that fixes the flaw.

The bug in a built-in PDF reader allowed attackers to steal sensitive files stored on the hard drives of computers that used the vulnerable Firefox version. The attack was used against both Windows and Linux users, Mozilla researcher Daniel Veditz wrote in a blog post published Thursday. The exploit code targeting Linux users uploaded cryptographically protected system passwords, bash command histories, secure shell (SSH) configurations and keys. The attacker downloaded several other files, including histories for MySQL and PgSQL and configurations for remina, Filezilla, and Psi+, text files that contained the strings pass and access in the names. Any shell scripts were also grabbed.

The attack targeting Windows users appeared to go after files of interest to software developers. The targeted data included subversion, s3browser, and Filezilla configurations files, .purple and Psi+ account information, and site configuration files from eight different popular FTP clients. Firefox users running Apples OS X were not targeted. The exploit was served in an advertisement on an undisclosed Russian news site, but Veditz said he could not rule out the possibility that other sites also hosted the attack. Some of those may have targeted Macs in addition to Windows and Linux.

The exploit leaves no trace it has been run on the local machine, Veditz wrote. If you use Firefox on Windows or Linux it would be prudent to change any passwords and keys found in the above mentioned files if you use the associated programs. People who use ad-blocking software may have been protected from this exploit depending on the software and specific filters being used.

According to a blog post published Friday by Martijn Grooten, a security researcher for Virus Bulletin, the bug allows attackers to create malicious PDF files that inject JavaScript code into the local file context. The exploit bypasses the same-origin policy, allowing attackers to download local files.

Mozilla has issued an emergency update patching the vulnerability. Users should check their version of Firefox to make sure they are running version 39.0.3. The fix has also been shipped in Firefox ESR 38.1.1.