1138808 - (CVE-2015-4494) Permission bypass for Wifi direct system messages

Status: RESOLVED FIXED

(Firefox OS Graveyard :: Wifi, defect)

Description

[Paul Theriault [:pauljt] (no longer reading bugmail)]

I'm not sure when WifiDirect was enabled but there appears to be no permission checks on the system messages:

https://dxr.mozilla.org/mozilla-central/source/dom/messages/SystemMessagePermissionsChecker.jsm#127

Unless I'm mistaken, that means any app could listen for these system messages, which is probably a privacy issue? It is documented as requiring the "wifi-manage" permission, but this is not how it is implemented. Marking as secure just in case, but its publicly documented so not sure how useful that is.

If this is actually an oversight, then this is probably a blocking bug, so marking 2.2?

The sec-rating is a guess, im not sure of the actually implication here, it may not actually be too bad.

Comment 1

[[:fabrice] Fabrice Desré]

I think you're right, since we broadcast these system messages (see http://mxr.mozilla.org/mozilla-central/ident?i=PAIRING_REQUEST_SYS_MSG).

Comment 2

[[:fabrice] Fabrice Desré]

Attachment: wifi-p2p.patch

Comment 3

[Vincent Chang[:vchang][changyihsin]]

Comment on attachment 8572057 [details] [diff] [review]
wifi-p2p.patch

Review of attachment 8572057 [details] [diff] [review]:
-----------------------------------------------------------------

Thanks for jumping to this.

Comment 4

[[:fabrice] Fabrice Desré]

https://hg.mozilla.org/integration/b2g-inbound/rev/07d9bcf2c1c1

Comment 5

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/07d9bcf2c1c1

Comment 6

[Ryan VanderMeulen [:RyanVM]]

Do we need to consider backporting this to any older releases?

Comment 7

[[:fabrice] Fabrice Desré]

(In reply to Ryan VanderMeulen [:RyanVM UTC-5] from comment #6)
> Do we need to consider backporting this to any older releases?

Would be good, yes. a=me for all branches down to 2.0

Comment 8

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-b2g37_v2_2/rev/303a47b92ecd
https://hg.mozilla.org/releases/mozilla-b2g34_v2_1/rev/28ffee0d5b0c
https://hg.mozilla.org/releases/mozilla-b2g32_v2_0/rev/e89ba447d264

Comment 9

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-b2g34_v2_1s/rev/28ffee0d5b0c
https://hg.mozilla.org/releases/mozilla-b2g32_v2_0m/rev/e89ba447d264

Comment 10

[Liz Henry (:lizzard) (relman/hg->git project)]

CCing bkerensa since he is release managing for ESR and wasn't able to see this.

Comment 11

[[:fabrice] Fabrice Desré]

We don't ship that code in desktop builds.