Mozilla Foundation Security Advisory 2009-53

Mozilla Foundation Security Advisory 2009-53

Title: Local downloaded file tampering
Impact: Low
Announced: October 27, 2009
Reporter: Jeremy Brown
Products: Firefox

Fixed in: Firefox 3.5.4
Firefox 3.0.15
Description

Security researcher Jeremy Brown reported that the file naming scheme used for downloading a file which already exists in the downloads folder is predictable. If an attacker had local access to a victim's computer and knew the name of a file the victim intended to open through the Download Manager, he could use this vulnerability to place a malicious file in the world-writable directory used to save temporary downloaded files and cause the browser to choose the incorrect file when opening it. Since this attack requires local access to the victim's machine, the severity of this vulnerability was determined to be low.
References

* https://bugzilla.mozilla.org/show_bug.cgi?id=514823
* CVE-2009-3274