This host is installed with Mozilla Firefox and is prone to insecure saving of downloadable file.

Local attackers may leverage this issue by replacing an arbitrary downloaded file by placing a file in a /tmp location before the download occurs. Impact Level: Application

Upgrade to Mozilla Firefox version 3.6.3 or later For updates refer to http://www.mozilla.com/en-US/firefox/

This security issue is due to the browser using a fixed path from the /tmp directory when a user opens a file downloaded for opening from the 'Downloads' window. This can be exploited to trick a user into opening a file with potentially malicious content by placing it in the /tmp directory before the download takes place.

Mozilla Firefox version 2.x, 3.x on Linux.

• http://jbrownsec.blogspot.com/2009/09/vamos-updates.html
• http://secunia.com/advisories/36649
• http://securitytube.net/Zero-Day-Demos-%28Firefox-Vulnerability-Discovered%29-video.aspx

---

Updated on 2015-03-25