Guide to the Secure Configuration for Firefox

with profile Upstream Firefox STIG
This profile is developed under the DoD consensus model and DISA FSO Vendor STIG process, serving as the upstream development environment for the Firefox STIG. As a result of the upstream/downstream relationship between the SCAP Security Guide project and the official DISA FSO STIG baseline, users should expect variance between SSG and DISA FSO content. For official DISA FSO STIG content, refer to http://iase.disa.mil/stigs/app-security/browser-guidance/Pages/index.aspx. While this profile is packaged by Red Hat as part of the SCAP Security Guide package, please note that commercial support of this SCAP content is NOT available. This profile is provided as example SCAP content with no endorsement for suitability or production readiness. Support for this profile is provided by the upstream SCAP Security Guide community on a best-effort basis. The upstream project homepage is https://fedorahosted.org/scap-security-guide/.

This guide presents a catalog of security-relevant configuration settings for firefox formatted in the eXtensible Configuration Checklist Description Format (XCCDF).

Providing system administrators with such guidance informs them how to securely configure systems under their control in a variety of network roles. Policy makers and baseline creators can use this catalog of settings, with its associated references to higher-level security control catalogs, in order to assist them in security baseline creation. This guide is a catalog, not a checklist, and satisfaction of every item is not likely to be possible or sensible in many operational scenarios. However, the XCCDF format enables granular selection and adjustment of settings, and their association with OVAL and OCIL content provides an automated checking capability. Transformations of this document, and its associated automated checking content, are capable of providing baselines that meet a diverse set of policy objectives. Some example XCCDF Profiles, which are selections of items that form checklists and can be used as baselines, are available with this guide. They can be processed, in an automated fashion, with tools that support the Security Content Automation Protocol (SCAP). The DISA STIG for RHEL 6 is one example of a baseline created from this guidance.
Do not attempt to implement any of the settings in this guide without first testing them in a non-operational environment. The creators of this guidance assume no responsibility whatsoever for its use by other parties, and makes no guarantees, expressed or implied, about its quality, reliability, or any other characteristic.

Evaluation Characteristics

Target machineshore-patrol.example.com
Benchmark URL/var/lib/openscap/content/0f75f9637bc46d0ab685b05ada9a8bd3ba55a9a6d083c9852e8235a3b7cd1d26.xml
Benchmark IDxccdf_org.ssgproject.content_benchmark_Firefox
Profile IDxccdf_org.ssgproject.content_profile_stig-firefox-upstream
Started at2017-02-16T11:42:18
Finished at2017-02-16T11:42:18
Performed byroot

CPE Platforms

  • cpe:/a:mozilla:firefox

Addresses

  • IPv4  127.0.0.1
  • IPv4  192.168.100.107
  • IPv6  0:0:0:0:0:0:0:1
  • IPv6  fe80:0:0:0:5054:ff:feba:8397
  • MAC  00:00:00:00:00:00
  • MAC  52:54:00:BA:83:97

Compliance and Scoring

The target system did not satisfy the conditions of 25 rules! Please review rule results and consider applying remediation.

Rule results

1 passed
25 failed
2 other

Severity of failed rules

0 other
0 low
25 medium
0 high

Score

Scoring systemScoreMaximumPercent
urn:xccdf:scoring:default4.166667100.000000
4.17%

Rule Overview

Group rules by:
TitleSeverityResult
Guide to the Secure Configuration for Firefox 25x fail 2x notchecked
Introduction
How to Use This Guide
Read Sections Completely and in Order
Test in Non-Production Environment
Root Shell Environment Assumed
Formatting Conventions
Firefox 25x fail 2x notchecked
Prevent Users from Changing Firefox Configuration Settings 2x fail
Disable Firefox Configuration File ROT-13 Encodingmedium
fail
Set Firefox Configuration File Locationmedium
fail
The DoD Root Certificate Is Required 2x notchecked
Enable Shared System Certificatesmedium
notchecked
The DoD Root Certificate Existsmedium
notchecked
Clearing Cookies And Other Data 2x fail
Clear Data When Firefox Closesmedium
fail
Disable User Prompt When Data Is Clearedmedium
fail
Disable Addons Plugin Updatesmedium
fail
Disable Autofill Form Assistancemedium
fail
Disable User Ability To Autofill Passwordsmedium
fail
Disable Firefox Auto-Update Capabilitymedium
fail
Enable Downloading and Opening File Confirmationmedium
fail
Disable the Firefox Password Storemedium
fail
Disable Installed Search Plugins Update Checkingmedium
fail
Disable Firefox Access to Shell Protocolsmedium
fail
Disable SSL Version 2.0 in Firefoxmedium
fail
Enable TLS Usage in Firefoxmedium
fail
Enable Certificate Verificationmedium
fail
Disable SSL Version 3.0 in Firefoxmedium
fail
Default Firefox Home Page Configuredmedium
fail
Supported Version of Firefox Installedhigh
pass
Disable JavaScript's Ability To Modify The Browser Appearancemedium
fail
Disable JavaScript Context Menusmedium
fail
Disable JavaScript's Ability To Change The Status Barmedium
fail
Disable JavaScript's Moving Or Resizing Windows Capabilitymedium
fail
Disable JavaScript's Raise Or Lower Windows Capabilitymedium
fail
Enable Non-Secure Page Warningsmedium
fail
Enable Firefox Pop-up Blockermedium
fail
Disable Automatic Downloads of MIME Typesmedium
fail

Result Details

Disable Firefox Configuration File ROT-13 Encodingxccdf_org.ssgproject.content_rule_firefox_preferences-lock_settings_obscure mediumDISA FSO DTBF070

Disable Firefox Configuration File ROT-13 Encoding

Rule IDxccdf_org.ssgproject.content_rule_firefox_preferences-lock_settings_obscure
Result
fail
Time2017-02-16T11:42:18
Severitymedium
Identifiers and References

identifiers:  DISA FSO DTBF070

references:  ECSC-1, http://iase.disa.mil/cci/index.html

Description

Disable ROT-13 encoding by setting general.config.obscure_value to 0.

Rationale

ROT-13 encoded prevents system adminstrators from easily configuring and deploying Firefox configuration settings. It also prevents validating settings easily from automated security tools.

OVAL details

Items not found violating Check for obscure_value:

Object oval:ssg:obj:162 of type textfilecontent54_object
PathFilenamePatternInstance
^\/usr\/(|local\/)lib(|64)\/firefox\/defaults\/preferences^.*\.js$^pref\("general.config.obscure_value",[\s]+0\);$1
Remediation script:
FIREFOX_DIRs="/usr/lib/firefox /usr/lib64/firefox /usr/local/lib/firefox /usr/local/lib64/firefox"
for FIREFOX_DIR in ${FIREFOX_DIRs}; do
  if [ -d ${FIREFOX_DIR} ] ; then
    PREFERENCE_DIR=${FIREFOX_DIR}/defaults/preferences/
    
    if [ ! -d ${PREFERENCE_DIR} ]; then
      mkdir -p -m 755 ${PREFERENCE_DIR}
    fi

    grep -q '^pref(\"general.config.obscure_value\", 0);' ${PREFERENCE_DIR}/security_settings.js && \
    sed -i 's/pref(\"general.config.obscure_value\".*/pref(\"general.config.obscure_value\", 0);/g' ${PREFERENCE_DIR}/security_settings.js
    if ! [ $? -eq 0 ] ; then
      echo 'pref("general.config.obscure_value", 0);' >> ${PREFERENCE_DIR}/security_settings.js
    fi
  fi
done
Set Firefox Configuration File Locationxccdf_org.ssgproject.content_rule_firefox_preferences-lock_settings_config_file mediumDISA FSO DTBF070

Set Firefox Configuration File Location

Rule IDxccdf_org.ssgproject.content_rule_firefox_preferences-lock_settings_config_file
Result
fail
Time2017-02-16T11:42:18
Severitymedium
Identifiers and References

identifiers:  DISA FSO DTBF070

references:  ECSC-1, http://iase.disa.mil/cci/index.html

Description

Specify the Firefox configuration file location by setting general.config.filename to the configuration (i.e. mozilla.cfg) filename that contains the Firefox security preferences.

Rationale

Locked settings prevents users from accessing about:config and changing the security settings set by the system administrator.

OVAL details

Items not found violating Check for configuration filename:

Object oval:ssg:obj:167 of type textfilecontent54_object
PathFilenamePatternInstance
^\/usr\/(|local\/)lib(|64)\/firefox\/defaults\/preferences^.*\.js$^pref\("general.config.filename",[\s]+"(\S+)\.cfg"\);$1
Remediation script:
FIREFOX_DIRs="/usr/lib/firefox /usr/lib64/firefox /usr/local/lib/firefox /usr/local/lib64/firefox"
for FIREFOX_DIR in ${FIREFOX_DIRs}; do
  if [ -d ${FIREFOX_DIR} ] ; then
    PREFERENCE_DIR=${FIREFOX_DIR}/defaults/preferences/
    
    if [ ! -d ${PREFERENCE_DIR} ]; then
      mkdir -p -m 755 ${PREFERENCE_DIR}
    fi

    grep -q 'pref(\"general.config.filename\", \"mozilla.cfg\");' ${PREFERENCE_DIR}/security_settings.js && \
    sed -i 's/pref(\"general.config.filename\".*/pref(\"general.config.filename\", \"mozilla.cfg\");/g' ${PREFERENCE_DIR}/security_settings.js
    if ! [ $? -eq 0 ] ; then
      echo 'pref("general.config.filename", "mozilla.cfg");' >> ${PREFERENCE_DIR}/security_settings.js
    fi
  fi
done
Enable Shared System Certificatesxccdf_org.ssgproject.content_rule_firefox_preferences-enable_ca_trust mediumCCE-27457-1

Enable Shared System Certificates

Rule IDxccdf_org.ssgproject.content_rule_firefox_preferences-enable_ca_trust
Result
notchecked
Time2017-02-16T11:42:18
Severitymedium
Identifiers and References

identifiers:  CCE-27457-1

references:  AC-10, 54

Description

The Shared System Certificates store makes NSS, GnuTLS, OpenSSL, and Java share a default source for retrieving system certificate anchors and blacklist information. Firefox has the capability of using this centralized store for its CA certificates. If the Shared System Certificates store is disabled, it can be enabled by running the following command:

$ sudo update-ca-trust enable

Rationale

The DOD root certificate will ensure that the trust chain is established for server certificates issued from the DOD CA.

Evaluation messages
info 
No candidate or applicable check found.
The DoD Root Certificate Existsxccdf_org.ssgproject.content_rule_firefox_preferences-dod_root_certificate_installed mediumCCE-27457-1

The DoD Root Certificate Exists

Rule IDxccdf_org.ssgproject.content_rule_firefox_preferences-dod_root_certificate_installed
Result
notchecked
Time2017-02-16T11:42:18
Severitymedium
Identifiers and References

identifiers:  CCE-27457-1

references:  AC-10, 54

Description

The DoD root certificate should be installed in the Shared System Certificates store for Firefox to be able to access the DoD certificate. To install the root certificated into the Shared System Certificates store, copy the DoD root certificate into /etc/pki/ca-trust/source/anchors. Once the file is copied, run the following command:

$ sudo update-ca-trust extract

Rationale

The DOD root certificate will ensure that the trust chain is established for server certificates issued from the DOD CA.

Evaluation messages
info 
No candidate or applicable check found.
Clear Data When Firefox Closesxccdf_org.ssgproject.content_rule_firefox_preferences-cookies_clear mediumDISA FSO DTBF170

Clear Data When Firefox Closes

Rule IDxccdf_org.ssgproject.content_rule_firefox_preferences-cookies_clear
Result
fail
Time2017-02-16T11:42:18
Severitymedium
Identifiers and References

identifiers:  DISA FSO DTBF170

references:  ECSC-1, http://iase.disa.mil/cci/index.html

Description

When a user browses to a website, cookies and other types of data get stored on the system. This can be disabled by setting privacy.sanitize.sanitizeOnShutdown to true.

Rationale

Cookies can help websites perform better but can also be part of spyware. To mitigate this risk, set browser preferences to perform a Clear Private Data operation when closing the browser in order to clear cookies and other data installed by websites visited during the session.

OVAL details

Items not found violating Check for sanitizeOnShutdown enabled:

Object oval:ssg:obj:173 of type textfilecontent54_object
PathFilenamePatternInstance
^\/usr\/(|local\/)lib(|64)\/firefox^.*\.cfg$^lockPref\("privacy.sanitize.sanitizeOnShutdown",[\s]+true\);$1
Remediation script:
FIREFOX_DIRs="/usr/lib/firefox /usr/lib64/firefox /usr/local/lib/firefox /usr/local/lib64/firefox"
for FIREFOX_DIR in ${FIREFOX_DIRs}; do
  if [ -d ${FIREFOX_DIR} ]; then
    grep -q '^lockPref(\"privacy.sanitize.sanitizeOnShutdown\", true);' ${FIREFOX_DIR}/mozilla.cfg && \
    sed -i 's/lockPref(\"privacy.sanitize.sanitizeOnShutdown\".*/lockPref(\"privacy.sanitize.sanitizeOnShutdown\", true);/g' ${FIREFOX_DIR}/mozilla.cfg
    if ! [ $? -eq 0 ] ; then
      echo 'lockPref("privacy.sanitize.sanitizeOnShutdown", true);' >> ${FIREFOX_DIR}/mozilla.cfg
    fi
  fi
done
Disable User Prompt When Data Is Clearedxccdf_org.ssgproject.content_rule_firefox_preferences-cookies_user_notice mediumDISA FSO DTBF170

Disable User Prompt When Data Is Cleared

Rule IDxccdf_org.ssgproject.content_rule_firefox_preferences-cookies_user_notice
Result
fail
Time2017-02-16T11:42:18
Severitymedium
Identifiers and References

identifiers:  DISA FSO DTBF170

references:  ECSC-1, http://iase.disa.mil/cci/index.html

Description

By default, users are asked if it is okay to clear out cookies and data when Firefox closes. This can be disabled by setting privacy.sanitize.promptOnSanitize to false.

Rationale

Cookies can help websites perform better but can also be part of spyware. To mitigate this risk, set browser preferences to perform a Clear Private Data operation when closing the browser in order to clear cookies and other data installed by websites visited during the session.

OVAL details

Items not found violating Check for promptOnSanitize disabled:

Object oval:ssg:obj:180 of type textfilecontent54_object
PathFilenamePatternInstance
^\/usr\/(|local\/)lib(|64)\/firefox^.*\.cfg$^lockPref\("privacy.sanitize.promptOnSanitize",[\s]+false\);$1
Remediation script:
FIREFOX_DIRs="/usr/lib/firefox /usr/lib64/firefox /usr/local/lib/firefox /usr/local/lib64/firefox"
for FIREFOX_DIR in ${FIREFOX_DIRs}; do
  if [ -d ${FIREFOX_DIR} ]; then
    grep -q '^lockPref(\"privacy.sanitize.promptOnSanitize\", false);' ${FIREFOX_DIR}/mozilla.cfg && \
    sed -i 's/lockPref(\"privacy.sanitize.promptOnSanitize\".*/lockPref(\"privacy.sanitize.promptOnSanitize\", false);/g' ${FIREFOX_DIR}/mozilla.cfg
    if ! [ $? -eq 0 ] ; then
      echo 'lockPref("privacy.sanitize.promptOnSanitize", false);' >> ${FIREFOX_DIR}/mozilla.cfg
    fi
  fi
done
Disable Addons Plugin Updatesxccdf_org.ssgproject.content_rule_firefox_preferences-addons_plugin_updates mediumDISA FSO DTBF090

Disable Addons Plugin Updates

Rule IDxccdf_org.ssgproject.content_rule_firefox_preferences-addons_plugin_updates
Result
fail
Time2017-02-16T11:42:18
Severitymedium
Identifiers and References

identifiers:  DISA FSO DTBF090

references:  ECSC-1, http://iase.disa.mil/cci/index.html

Description

Firefox automatically updates installed add-ons and plugins which can be disabled by setting extensions.update.enabled to false.

Rationale

Automatic updates from untrusted sites puts the enclave at risk of attack and may override security settings.

OVAL details

Items not found violating Check for addons plugin updates:

Object oval:ssg:obj:174 of type textfilecontent54_object
PathFilenamePatternInstance
^\/usr\/(|local\/)lib(|64)\/firefox^.*\.cfg$^lockPref\("extensions.update.enabled",[\s]+false\);$1
Remediation script:
FIREFOX_DIRs="/usr/lib/firefox /usr/lib64/firefox /usr/local/lib/firefox /usr/local/lib64/firefox"
for FIREFOX_DIR in ${FIREFOX_DIRs}; do
  if [ -d ${FIREFOX_DIR} ]; then
    grep -q '^lockPref(\"extensions.update.enabled\", false);' ${FIREFOX_DIR}/mozilla.cfg && \
    sed -i 's/lockPref(\"extensions.update.enabled\".*/lockPref(\"extensions.update.enabled\", false);/g' ${FIREFOX_DIR}/mozilla.cfg
    if ! [ $? -eq 0 ] ; then
        echo "lockPref(\"extensions.update.enabled\", false);" >> ${FIREFOX_DIR}/mozilla.cfg
    fi
  fi
done

Disable Autofill Form Assistancexccdf_org.ssgproject.content_rule_firefox_preferences-autofill_forms mediumDISA FSO DTBF140

Disable Autofill Form Assistance

Rule IDxccdf_org.ssgproject.content_rule_firefox_preferences-autofill_forms
Result
fail
Time2017-02-16T11:42:18
Severitymedium
Identifiers and References

identifiers:  DISA FSO DTBF140

references:  ECSC-1, http://iase.disa.mil/cci/index.html

Description

Firefox provides tools to auto-fill forms from prefilled information. This can be disabled by setting browser.formfill.enable to false.

Rationale

In order to protect privacy and sensitive data, Firefox provides the ability to configure Firefox such that data entered into forms is not saved. This mitigates the risk of a website gleaning private information from prefilled information.

OVAL details

Items not found violating Check for autofill_forms disabled:

Object oval:ssg:obj:166 of type textfilecontent54_object
PathFilenamePatternInstance
^\/usr\/(|local\/)lib(|64)\/firefox^.*\.cfg$^lockPref\("browser.formfill.enable",[\s]+false\);$1
Remediation script:
FIREFOX_DIRs="/usr/lib/firefox /usr/lib64/firefox /usr/local/lib/firefox /usr/local/lib64/firefox"
for FIREFOX_DIR in ${FIREFOX_DIRs}; do
  if [ -d ${FIREFOX_DIR} ]; then
    grep -q '^lockPref(\"browser.formfill.enable\", false);' ${FIREFOX_DIR}/mozilla.cfg && \
    sed -i 's/lockPref(\"browser.formfill.enable\".*/lockPref(\"browser.formfill.enable\", false);/g' ${FIREFOX_DIR}/mozilla.cfg
    if ! [ $? -eq 0 ] ; then
      echo 'lockPref("browser.formfill.enable", false);' >> ${FIREFOX_DIR}/mozilla.cfg
    fi
  fi
done
Disable User Ability To Autofill Passwordsxccdf_org.ssgproject.content_rule_firefox_preferences-autofill_passwords mediumDISA FSO DTBF150

Disable User Ability To Autofill Passwords

Rule IDxccdf_org.ssgproject.content_rule_firefox_preferences-autofill_passwords
Result
fail
Time2017-02-16T11:42:18
Severitymedium
Identifiers and References

identifiers:  DISA FSO DTBF150

references:  ECSC-1, http://iase.disa.mil/cci/index.html

Description

Firefox automatically allows users to save passwords to be auto-filled into password forms. This can be disabled by setting signon.prefillForms to false.

Rationale

While on the internet, it may be possible for an attacker to view the saved password files and gain access to the user's accounts on various hosts.

OVAL details

Items not found violating Check for autofill_passwords disabled:

Object oval:ssg:obj:160 of type textfilecontent54_object
PathFilenamePatternInstance
^\/usr\/(|local\/)lib(|64)\/firefox^.*\.cfg$^lockPref\("signon.prefillForms",[\s]+false\);$1
Remediation script:
FIREFOX_DIRs="/usr/lib/firefox /usr/lib64/firefox /usr/local/lib/firefox /usr/local/lib64/firefox"
for FIREFOX_DIR in ${FIREFOX_DIRs}; do
  if [ -d ${FIREFOX_DIR} ]; then
    grep -q '^lockPref(\"signon.prefillForms\", false);' ${FIREFOX_DIR}/mozilla.cfg && \
    sed -i 's/lockPref(\"signon.prefillForms\".*/lockPref(\"signon.prefillForms\", false);/g' ${FIREFOX_DIR}/mozilla.cfg
    if ! [ $? -eq 0 ] ; then 
      echo 'lockPref("signon.prefillForms", false);' >> ${FIREFOX_DIR}/mozilla.cfg
    fi
  fi
done
Disable Firefox Auto-Update Capabilityxccdf_org.ssgproject.content_rule_firefox_preferences-auto-update_of_firefox mediumDISA FSO DTBF080

Disable Firefox Auto-Update Capability

Rule IDxccdf_org.ssgproject.content_rule_firefox_preferences-auto-update_of_firefox
Result
fail
Time2017-02-16T11:42:18
Severitymedium
Identifiers and References

identifiers:  DISA FSO DTBF080

references:  ECSC-1, http://iase.disa.mil/cci/index.html

Description

Firefox can be set to automatically update as new updates. This can be disabled by setting app.update.enable to false.

Rationale

Allowing software updates from non-trusted sites can introduce settings that will override a secured installation of the application. This can place DoD information at risk. If this setting is enabled, then there are many other default settings which point to untrusted sites which must be changed to point to an authorized update site that is not publicly accessible.

OVAL details

Items not found violating Check that auto-update of firefox is disabled:

Object oval:ssg:obj:158 of type textfilecontent54_object
PathFilenamePatternInstance
^\/usr\/(|local\/)lib(|64)\/firefox^.*\.cfg$^lockPref\("app.update.enabled",[\s]+false\);$1
Remediation script:
FIREFOX_DIRs="/usr/lib/firefox /usr/lib64/firefox /usr/local/lib/firefox /usr/local/lib64/firefox"
for FIREFOX_DIR in ${FIREFOX_DIRs}; do
  if [ -d ${FIREFOX_DIR} ]; then
    grep -q '^lockPref(\"app.update.enabled\", false);' ${FIREFOX_DIR}/mozilla.cfg && \
    sed -i 's/lockPref(\"app.update.enabled\".*/lockPref(\"app.update.enabled\", false);/g' ${FIREFOX_DIR}/mozilla.cfg
    if ! [ $? -eq 0 ] ; then
      echo 'lockPref("app.update.enabled", false);' >> ${FIREFOX_DIR}/mozilla.cfg
    fi
  fi
done
Enable Downloading and Opening File Confirmationxccdf_org.ssgproject.content_rule_firefox_preferences-open_confirmation mediumDISA FSO DTBF110

Enable Downloading and Opening File Confirmation

Rule IDxccdf_org.ssgproject.content_rule_firefox_preferences-open_confirmation
Result
fail
Time2017-02-16T11:42:18
Severitymedium
Identifiers and References

identifiers:  DISA FSO DTBF110

references:  ECSC-1, http://iase.disa.mil/cci/index.html

Description

To have an action dialog box appear promping users what action to take when certain types of files are downloaded or opened, set plugin.disable_full_page_plugin_for_types to application/pdf,application/doc,application/xls,application/bat,application/ppt,application/mdb,application/mde,application/fdf,application/xfdf,application/lsl,application/lso,appliation/lss,application/iqy,application/rqy,application/xlk,application/pot,application/pps,application/dot,application/wbk,application/ps,application/eps,application/wch,application/wcm,application/wbi,application/wb1,application/wb3,application/rtf,application/wch,application/wcm,application/ad,application/adp,application/xlt,application/dos,application/wks.

Rationale

When the user receives a dialog box asking if they want to save the file or open it with a specified application, this indicates that a plugin does not exist. Also, the user has not previously selected a download action or helper application to automatically use for that type of file. When prompted, if the user checks the option to 'Do this automatically for files like this from now on', then an entry will appear for that type of file in the plugins listing, and this file type is automatically opened in the future. This can be a security issue. New file types cannot be added directly to the Application plugin listing.

OVAL details

Items not found violating Check for open_confirmation configured:

Object oval:ssg:obj:168 of type textfilecontent54_object
PathFilenamePatternInstance
^\/usr\/(|local\/)lib(|64)\/firefox^.*\.cfg$^lockPref\("plugin.disable_full_page_plugin_for_types",[\s]+"(\S+)"\);$1
State oval:ssg:ste:169 of type textfilecontent54_state
Subexpression
application/pdf,application/doc,application/xls,application/bat,application/ppt,application/mdb,application/mde,application/fdf,application/xfdf,application/lsl,application/lso,appliation/lss,application/iqy,application/rqy,application/xlk,application/pot,application/pps,application/dot,application/wbk,application/ps,application/eps,application/wch,application/wcm,application/wbi,application/wb1,application/wb3,application/rtf,application/wch,application/wcm,application/ad,application/adp,application/xlt,application/dos,application/wks
Remediation script:
var_required_file_types="application/pdf,application/doc,application/xls,application/bat,application/ppt,application/mdb,application/mde,application/fdf,application/xfdf,application/lsl,application/lso,appliation/lss,application/iqy,application/rqy,application/xlk,application/pot,application/pps,application/dot,application/wbk,application/ps,application/eps,application/wch,application/wcm,application/wbi,application/wb1,application/wb3,application/rtf,application/wch,application/wcm,application/ad,application/adp,application/xlt,application/dos,application/wks"
FIREFOX_DIRs="/usr/lib/firefox /usr/lib64/firefox /usr/local/lib/firefox /usr/local/lib64/firefox"
for FIREFOX_DIR in ${FIREFOX_DIRs}; do
  if [ -d ${FIREFOX_DIR} ]; then
    grep -q '^lockPref(\"plugin.disable_full_page_plugin_for_types\"' ${FIREFOX_DIR}/mozilla.cfg && \
    sed -i "s;lockPref(\"plugin.disable_full_page_plugin_for_types\".*;lockPref(\"plugin.disable_full_page_plugin_for_types\", \"${var_required_file_types}\")\;;g" ${FIREFOX_DIR}/mozilla.cfg
    if ! [ $? -eq 0 ] ; then
      echo "lockPref(\"plugin.disable_full_page_plugin_for_types\", \"${var_required_file_types}\");" >> ${FIREFOX_DIR}/mozilla.cfg
    fi
  fi
done
Disable the Firefox Password Storexccdf_org.ssgproject.content_rule_firefox_preferences-password_store mediumDISA FSO DTBF160

Disable the Firefox Password Store

Rule IDxccdf_org.ssgproject.content_rule_firefox_preferences-password_store
Result
fail
Time2017-02-16T11:42:18
Severitymedium
Identifiers and References

identifiers:  DISA FSO DTBF160

references:  ECSC-1, http://iase.disa.mil/cci/index.html

Description

Firefox allows users to store passwords whether or not a master password is set for the password store. To disable the storing of passwords, set signon.rememberSignons to false.

Rationale

Autofill of a password can be enabled when a site is visited. This feature could also be used to autofill the certificate pin which could lead to compromise of DoD information.

OVAL details

Items not found violating Check that the password_store is disabled:

Object oval:ssg:obj:177 of type textfilecontent54_object
PathFilenamePatternInstance
^\/usr\/(|local\/)lib(|64)\/firefox^.*\.cfg$^lockPref\("signon.rememberSignons",[\s]+false\);$1
Remediation script:
FIREFOX_DIRs="/usr/lib/firefox /usr/lib64/firefox /usr/local/lib/firefox /usr/local/lib64/firefox"
for FIREFOX_DIR in ${FIREFOX_DIRs}; do
  if [ -d ${FIREFOX_DIR} ] ; then
    grep -q '^lockPref(\"signon.rememberSignons\", false);' ${FIREFOX_DIR}/mozilla.cfg && \
    sed -i 's/lockPref(\"signon.rememberSignons\".*/lockPref(\"signon.rememberSignons\", false);/g' ${FIREFOX_DIR}/mozilla.cfg
    if ! [ $? -eq 0 ] ; then
      echo 'lockPref("signon.rememberSignons", false);' >> ${FIREFOX_DIR}/mozilla.cfg
    fi
  fi
done
Disable Installed Search Plugins Update Checkingxccdf_org.ssgproject.content_rule_firefox_preferences-search_update mediumDISA FSO DTBF085

Disable Installed Search Plugins Update Checking

Rule IDxccdf_org.ssgproject.content_rule_firefox_preferences-search_update
Result
fail
Time2017-02-16T11:42:18
Severitymedium
Identifiers and References

identifiers:  DISA FSO DTBF085

references:  ECSC-1, http://iase.disa.mil/cci/index.html

Description

Firefox automatically checks for updated versions of search plugins. To disable the automatic updates of plugins, set browser.search.update to false.

Rationale

Updates need to be controlled and installed from authorized and trusted servers. This setting overrides a number of other settings which may direct the application to access external URLs.

OVAL details

Items not found violating Check search plugin update capability is disabled:

Object oval:ssg:obj:176 of type textfilecontent54_object
PathFilenamePatternInstance
^\/usr\/(|local\/)lib(|64)\/firefox^.*\.cfg$^lockPref\("browser.search.update",[\s]+false\);$1
Remediation script:
FIREFOX_DIRs="/usr/lib/firefox /usr/lib64/firefox /usr/local/lib/firefox /usr/local/lib64/firefox"
for FIREFOX_DIR in ${FIREFOX_DIRs}; do
  if [ -d ${FIREFOX_DIR} ]; then
    grep -q '^lockPref(\"browser.search.update\", false);' ${FIREFOX_DIR}/mozilla.cfg && \
    sed -i 's/lockPref(\"browser.search.update\".*/lockPref(\"browser.search.update\", false);/g' ${FIREFOX_DIR}/mozilla.cfg
    if ! [ $? -eq 0 ] ; then
      echo 'lockPref("browser.search.update", false);' >> ${FIREFOX_DIR}/mozilla.cfg
    fi
  fi
done
Disable Firefox Access to Shell Protocolsxccdf_org.ssgproject.content_rule_firefox_preferences-shell_protocol mediumDISA FSO DTBF105

Disable Firefox Access to Shell Protocols

Rule IDxccdf_org.ssgproject.content_rule_firefox_preferences-shell_protocol
Result
fail
Time2017-02-16T11:42:18
Severitymedium
Identifiers and References

identifiers:  DISA FSO DTBF105

references:  ECSC-1, http://iase.disa.mil/cci/index.html

Description

Access to the shell is disabled by default but can be changed. To prevent shell access from being enabled, set network.protocol-handler.external.shell to false.

Rationale

If enabled, this setting would allow the browser to access the Windows shell. This could allow access to the underlying system.

OVAL details

Items not found violating Check that the hell_protocol is disabled:

Object oval:ssg:obj:175 of type textfilecontent54_object
PathFilenamePatternInstance
^\/usr\/(|local\/)lib(|64)\/firefox^.*\.cfg$^lockPref\("network.protocol-handler.external.shell",[\s]+false\);$1
Remediation script:
FIREFOX_DIRs="/usr/lib/firefox /usr/lib64/firefox /usr/local/lib/firefox /usr/local/lib64/firefox"
for FIREFOX_DIR in ${FIREFOX_DIRs}; do
  if [ -d ${FIREFOX_DIR} ]; then
    grep -q '^lockPref(\"network.protocol-handler.external.shell\", false);' ${FIREFOX_DIR}/mozilla.cfg && \
    sed -i 's/lockPref(\"network.protocol-handler.external.shell\".*/lockPref(\"network.protocol-handler.external.shell\", false);/g' ${FIREFOX_DIR}/mozilla.cfg
    if ! [ $? -eq 0 ] ; then
      echo 'lockPref("network.protocol-handler.external.shell", false);' >> ${FIREFOX_DIR}/mozilla.cfg
    fi
  fi
done
Disable SSL Version 2.0 in Firefoxxccdf_org.ssgproject.content_rule_firefox_preferences-ssl_version_2 mediumDISA FSO DTBF010

Disable SSL Version 2.0 in Firefox

Rule IDxccdf_org.ssgproject.content_rule_firefox_preferences-ssl_version_2
Result
fail
Time2017-02-16T11:42:18
Severitymedium
Identifiers and References

identifiers:  DISA FSO DTBF010

references:  ECSC-1, http://iase.disa.mil/cci/index.html

Description

SSL version 2 is not enabled by default and should not be enabled. To prevent SSL version 2 from being enabled set security.enable_ssl2 to false.

Rationale

Use of versions prior to TLS 1.0 are not permitted because these versions are non-standard. SSL 2.0 and SSL 3.0 contain a number of security flaws.

OVAL details

Items not found violating Check SSL 2.0 protocol disabled:

Object oval:ssg:obj:171 of type textfilecontent54_object
PathFilenamePatternInstance
^\/usr\/(|local\/)lib(|64)\/firefox^.*\.cfg$^lockPref\("security.enable_ssl2",[\s]+false\);$1
Remediation script:
FIREFOX_DIRs="/usr/lib/firefox /usr/lib64/firefox /usr/local/lib/firefox /usr/local/lib64/firefox"
for FIREFOX_DIR in ${FIREFOX_DIRs}; do
  if [ -d ${FIREFOX_DIR} ]; then
    grep -q '^lockPref(\"security.enable_ssl2\", false);' ${FIREFOX_DIR}/mozilla.cfg && \
    sed -i 's/lockPref(\"security.enable_ssl2\".*/lockPref(\"security.enable_ssl2\", false);/g' ${FIREFOX_DIR}/mozilla.cfg
    if ! [ $? -eq 0 ] ; then
      echo 'lockPref("security.enable_ssl2", false);' >> ${FIREFOX_DIR}/mozilla.cfg
    fi
  fi
done
Enable TLS Usage in Firefoxxccdf_org.ssgproject.content_rule_firefox_preferences-ssl_protocol_tls mediumDISA FSO DTBF030

Enable TLS Usage in Firefox

Rule IDxccdf_org.ssgproject.content_rule_firefox_preferences-ssl_protocol_tls
Result
fail
Time2017-02-16T11:42:18
Severitymedium
Identifiers and References

identifiers:  DISA FSO DTBF030

references:  ECSC-1, http://iase.disa.mil/cci/index.html

Description

To enable TLS, set security.enable_tls to true.

Rationale

Earlier versions of SSL have known security vulnerabilities and are not authorized for use in DOD environments.

OVAL details

Items not found violating Check if TLS is enabled:

Object oval:ssg:obj:172 of type textfilecontent54_object
PathFilenamePatternInstance
^\/usr\/(|local\/)lib(|64)\/firefox^.*\.cfg$^lockPref\("security.enable_tls",[\s]+true\);$1
Remediation script:
FIREFOX_DIRs="/usr/lib/firefox /usr/lib64/firefox /usr/local/lib/firefox /usr/local/lib64/firefox"
for FIREFOX_DIR in ${FIREFOX_DIRs}; do
  if [ -d ${FIREFOX_DIR} ]; then
    grep -q '^lockPref(\"security.enable_tls\", true);' ${FIREFOX_DIR}/mozilla.cfg && \
    sed -i 's/lockPref(\"security.enable_tls\".*/lockPref(\"security.enable_tls\", true);/g' ${FIREFOX_DIR}/mozilla.cfg
    if ! [ $? -eq 0 ] ; then
      echo 'lockPref("security.enable_tls", true);' >> ${FIREFOX_DIR}/mozilla.cfg
    fi
  fi
done
Enable Certificate Verificationxccdf_org.ssgproject.content_rule_firefox_preferences-verification mediumDISA FSO DTBF050

Enable Certificate Verification

Rule IDxccdf_org.ssgproject.content_rule_firefox_preferences-verification
Result
fail
Time2017-02-16T11:42:18
Severitymedium
Identifiers and References

identifiers:  DISA FSO DTBF050

references:  ECSC-1, http://iase.disa.mil/cci/index.html

Description

Firefox can be configured to prompt the user to choose a certificate to present to a website when asked. To enable certificate verification, set security.default_personal_cert to Ask Every Time.

Rationale

Websites within DoD require user authentication for access which increases security for DoD information. Access will be denied to the user if certificate management is not configured.

OVAL details

Items not found violating Enable Certification verification:

Object oval:ssg:obj:161 of type textfilecontent54_object
PathFilenamePatternInstance
^\/usr\/(|local\/)lib(|64)\/firefox^.*\.cfg$^lockPref\("security.default_personal_cert",[\s]+"Ask Every Time"\);$1
Remediation script:
FIREFOX_DIRs="/usr/lib/firefox /usr/lib64/firefox /usr/local/lib/firefox /usr/local/lib64/firefox"
for FIREFOX_DIR in ${FIREFOX_DIRs}; do
  if [ -d ${FIREFOX_DIR} ]; then
    grep -q '^lockPref(\"security.default_personal_cert\", \"Ask Every Time\");' ${FIREFOX_DIR}/mozilla.cfg && \
    sed -i 's/lockPref(\"security.default_personal_cert\".*/lockPref(\"security.default_personal_cert\", \"Ask Every Time\");/g' ${FIREFOX_DIR}/mozilla.cfg
    if ! [ $? -eq 0 ]; then
      echo 'lockPref("security.default_personal_cert", "Ask Every Time");' >> ${FIREFOX_DIR}/mozilla.cfg
    fi
  fi
done
Disable SSL Version 3.0 in Firefoxxccdf_org.ssgproject.content_rule_firefox_preferences-ssl_version_3 mediumDISA FSO DTBF020

Disable SSL Version 3.0 in Firefox

Rule IDxccdf_org.ssgproject.content_rule_firefox_preferences-ssl_version_3
Result
fail
Time2017-02-16T11:42:18
Severitymedium
Identifiers and References

identifiers:  DISA FSO DTBF020

references:  ECSC-1, http://iase.disa.mil/cci/index.html

Description

SSL version 3.0 is vulnerable and should be disabled by setting security.enable_ssl3 to false.

Rationale

Earlier versions of SSL have known security vulnerabilities and are not authorized for use in DOD.

OVAL details

Items not found violating Check for SSL Version 3 preferences:

Object oval:ssg:obj:178 of type textfilecontent54_object
PathFilenamePatternInstance
^\/usr\/(|local\/)lib(|64)\/firefox^.*\.cfg$^lockPref\("security.enable_ssl3",[\s]+false\);$1
Remediation script:
FIREFOX_DIRs="/usr/lib/firefox /usr/lib64/firefox /usr/local/lib/firefox /usr/local/lib64/firefox"
for FIREFOX_DIR in ${FIREFOX_DIRs}; do
  if [ -d ${FIREFOX_DIR} ]; then
    grep -q '^lockPref(\"security.enable_ssl3\", false);' ${FIREFOX_DIR}/mozilla.cfg && \
    sed -i 's/lockPref(\"security.enable_ssl3\".*/lockPref(\"security.enable_ssl3\", false);/g' ${FIREFOX_DIR}/mozilla.cfg
    if ! [ $? -eq 0 ] ; then
      echo 'lockPref("security.enable_ssl3", false);' >> ${FIREFOX_DIR}/mozilla.cfg
    fi
  fi
done
Default Firefox Home Page Configuredxccdf_org.ssgproject.content_rule_firefox_preferences-home_page mediumDISA FSO DTBF017

Default Firefox Home Page Configured

Rule IDxccdf_org.ssgproject.content_rule_firefox_preferences-home_page
Result
fail
Time2017-02-16T11:42:18
Severitymedium
Identifiers and References

identifiers:  DISA FSO DTBF017

references:  ECSC-1, http://iase.disa.mil/cci/index.html

Description

The default home page is set to a vendor's defined website or Firefox's own website. This can be changed to an organizationally defined website or about:blank. To set the default home page, set browser.startup.homepage to about:blank.

Rationale

The browser home page parameter specifies the web page that is to be displayed when the browser is started explicitly and when product-specific buttons or key sequences for the home page are accessed. This helps to mitigate the possibility of automatic inadvertent execution of scripts added to a previously safe site.

OVAL details

Items not found violating Check for home page configured:

Object oval:ssg:obj:163 of type textfilecontent54_object
PathFilenamePatternInstance
^\/usr\/(|local\/)lib(|64)\/firefox^.*\.cfg$^lockPref\("browser.startup.homepage",[\s]+"(\S+)"\);$1
State oval:ssg:ste:164 of type textfilecontent54_state
Subexpression
about:blank
Remediation script:
var_default_home_page="about:blank"
FIREFOX_DIRs="/usr/lib/firefox /usr/lib64/firefox /usr/local/lib/firefox /usr/local/lib64/firefox"
for FIREFOX_DIR in ${FIREFOX_DIRs}; do
  if [ -d ${FIREFOX_DIR} ]; then
    grep -q '^lockPref(\"browser.startup.homepage\"' ${FIREFOX_DIR}/mozilla.cfg && \
    sed -i "s;lockPref(\"browser.startup.homepage\".*;lockPref(\"browser.startup.homepage\", \"${var_default_home_page}\")\;;g" ${FIREFOX_DIR}/mozilla.cfg
    if ! [ $? -eq 0 ] ; then
      echo "lockPref(\"browser.startup.homepage\", \"${var_default_home_page}\");" >> ${FIREFOX_DIR}/mozilla.cfg
    fi
  fi
done
Supported Version of Firefox Installedxccdf_org.ssgproject.content_rule_installed_firefox_version_supported highDISA FSO DTBF003

Supported Version of Firefox Installed

Rule IDxccdf_org.ssgproject.content_rule_installed_firefox_version_supported
Result
pass
Time2017-02-16T11:42:18
Severityhigh
Identifiers and References

identifiers:  DISA FSO DTBF003

references:  DCMC-1, http://iase.disa.mil/cci/index.html

Description

If the system is joined to the Red Hat Network, a Red Hat Satellite Server, or a yum server, run the following command to install updates:

$ sudo yum update
If the system is not configured to use one of these sources, updates (in the form of RPM packages) can be manually downloaded and installed using rpm.

Rationale

Use of versions of an application which are not supported by the vendor are not permitted. Vendors respond to security flaws with updates and patches. These updates are not available for unsupported version which can leave the application vulnerable to attack.

OVAL details

Items found satisfying Installed version of firefox is greater than ESR 31.5:

NameArchEpochReleaseVersionEvrSignature keyidExtended name
firefoxx86_64(none)1.el7.centos45.7.00:45.7.0-1.el7.centos24c6a8a7f4a80eb5firefox-0:45.7.0-1.el7.centos.x86_64
Disable JavaScript's Ability To Modify The Browser Appearancexccdf_org.ssgproject.content_rule_firefox_preferences-javascript_status_bar_text mediumDISA FSO DTBF185

Disable JavaScript's Ability To Modify The Browser Appearance

Rule IDxccdf_org.ssgproject.content_rule_firefox_preferences-javascript_status_bar_text
Result
fail
Time2017-02-16T11:42:18
Severitymedium
Identifiers and References

identifiers:  DISA FSO DTBF185

references:  ECSC-1, http://iase.disa.mil/cci/index.html

Description

JavaScript can configure and make changes to the web browser's appearance by specifically hiding the status bar from view. This can disabled by setting dom.disable_window_open_feature.status to true.

Rationale

JavaScript can make changes to the browser’s appearance. This activity can help disguise an attack taking place in a minimized background window. Webpage authors can disable many features of a popup window that they open. This setting prevents the status bar from being hidden.

OVAL details

Items not found violating Check that changing the status bar text is disabled:

Object oval:ssg:obj:181 of type textfilecontent54_object
PathFilenamePatternInstance
^\/usr\/(|local\/)lib(|64)\/firefox^.*\.cfg$^lockPref\("dom.disable_window_open_feature.status",[\s]+true\);$1
Remediation script:
FIREFOX_DIRs="/usr/lib/firefox /usr/lib64/firefox /usr/local/lib/firefox /usr/local/lib64/firefox"
for FIREFOX_DIR in ${FIREFOX_DIRs}; do
  if [ -d ${FIREFOX_DIR} ]; then
    grep -q '^lockPref(\"dom.disable_window_open_feature.status\", true);' ${FIREFOX_DIR}/mozilla.cfg && \
    sed -i 's/lockPref(\"dom.disable_window_open_feature.status\".*/lockPref(\"dom.disable_window_open_feature.status\", true);/g' ${FIREFOX_DIR}/mozilla.cfg
    if ! [ $? -eq 0 ] ; then
      echo 'lockPref("dom.disable_window_open_feature.status", true);' >> ${FIREFOX_DIR}/mozilla.cfg
    fi
  fi
done
Disable JavaScript Context Menusxccdf_org.ssgproject.content_rule_firefox_preferences-javascript_context_menus mediumDISA FSO DTBF183

Disable JavaScript Context Menus

Rule IDxccdf_org.ssgproject.content_rule_firefox_preferences-javascript_context_menus
Result
fail
Time2017-02-16T11:42:18
Severitymedium
Identifiers and References

identifiers:  DISA FSO DTBF183

references:  ECSC-1, http://iase.disa.mil/cci/index.html

Description

JavaScript can configure and make changes to the web browser's appearance by specifically disabling or replacing context menus. This can be disabled by setting dom.event.contextmenu.enabled to false.

Rationale

A website may execute JavaScript that can make changes to these context menus. This can help disguise an attack.

OVAL details

Items not found violating Check for disable javaScript context menu is disabled:

Object oval:ssg:obj:182 of type textfilecontent54_object
PathFilenamePatternInstance
^\/usr\/(|local\/)lib(|64)\/firefox^.*\.cfg$^lockPref\("dom.event.contextmenu.enabled",[\s]+false\);$1
Remediation script:
FIREFOX_DIRs="/usr/lib/firefox /usr/lib64/firefox /usr/local/lib/firefox /usr/local/lib64/firefox"
for FIREFOX_DIR in ${FIREFOX_DIRs}; do
  if [ -d ${FIREFOX_DIR} ]; then
    grep -q '^lockPref(\"dom.event.contextmenu.enabled\", false);' ${FIREFOX_DIR}/mozilla.cfg && \
    sed -i 's/lockPref(\"dom.event.contextmenu.enabled\".*/lockPref(\"dom.event.contextmenu.enabled\", false);/g' ${FIREFOX_DIR}/mozilla.cfg
    if ! [ $? -eq 0 ] ; then
      echo 'lockPref("dom.event.contextmenu.enabled", false);' >> ${FIREFOX_DIR}/mozilla.cfg
    fi
  fi
done

Disable JavaScript's Ability To Change The Status Barxccdf_org.ssgproject.content_rule_firefox_preferences-javascript_status_bar_changes mediumDISA FSO DTBF184

Disable JavaScript's Ability To Change The Status Bar

Rule IDxccdf_org.ssgproject.content_rule_firefox_preferences-javascript_status_bar_changes
Result
fail
Time2017-02-16T11:42:18
Severitymedium
Identifiers and References

identifiers:  DISA FSO DTBF184

references:  ECSC-1, http://iase.disa.mil/cci/index.html

Description

JavaScript can configure and make changes to the web browser's appearance by specifically hiding or changing the status bar. This can be disabled by setting dom.disable_window_status_change to true.

Rationale

When a user visits some webpages, JavaScript can hide or make changes to the browser’s appearance to hide unauthorized activity. This activity can help disguise an attack taking place in a minimized background window.

OVAL details

Items not found violating Check that hiding or changing status bar is disabled:

Object oval:ssg:obj:183 of type textfilecontent54_object
PathFilenamePatternInstance
^\/usr\/(|local\/)lib(|64)\/firefox^.*\.cfg$^lockPref\("dom.disable_window_status_change",[\s]+true\);$1
Remediation script:
FIREFOX_DIRs="/usr/lib/firefox /usr/lib64/firefox /usr/local/lib/firefox /usr/local/lib64/firefox"
for FIREFOX_DIR in ${FIREFOX_DIRs}; do
  if [ -d ${FIREFOX_DIR} ]; then
    grep -q '^lockPref(\"dom.disable_window_status_change\", true);' ${FIREFOX_DIR}/mozilla.cfg && \
    sed -i 's/lockPref(\"dom.disable_window_status_change\".*/lockPref(\"dom.disable_window_status_change\", true);/g' ${FIREFOX_DIR}/mozilla.cfg
    if ! [ $? -eq 0 ] ; then
      echo 'lockPref("dom.disable_window_status_change", true);' >> ${FIREFOX_DIR}/mozilla.cfg
    fi
  fi
done
Disable JavaScript's Moving Or Resizing Windows Capabilityxccdf_org.ssgproject.content_rule_firefox_preferences-javascript_window_resizing mediumDISA FSO DTBF181

Disable JavaScript's Moving Or Resizing Windows Capability

Rule IDxccdf_org.ssgproject.content_rule_firefox_preferences-javascript_window_resizing
Result
fail
Time2017-02-16T11:42:18
Severitymedium
Identifiers and References

identifiers:  DISA FSO DTBF181

references:  ECSC-1, http://iase.disa.mil/cci/index.html

Description

JavaScript can configure and make changes to the web browser's appearance by specifically moving and resizing browser windows. This can be disabled by setting dom.disable_window_move_resize to true.

Rationale

JavaScript can make changes to the browser’s appearance. This activity can help disguise an attack taking place in a minimized background window.

OVAL details

Items not found violating Check for move or resize windows disabled:

Object oval:ssg:obj:184 of type textfilecontent54_object
PathFilenamePatternInstance
^\/usr\/(|local\/)lib(|64)\/firefox^.*\.cfg$^lockPref\("dom.disable_window_move_resize",[\s]+true\);$1
Remediation script:
FIREFOX_DIRs="/usr/lib/firefox /usr/lib64/firefox /usr/local/lib/firefox /usr/local/lib64/firefox"
for FIREFOX_DIR in ${FIREFOX_DIRs}; do
  if [ -d ${FIREFOX_DIR} ]; then
    grep -q '^lockPref(\"dom.disable_window_move_resize\", true);' ${FIREFOX_DIR}/mozilla.cfg && \
    sed -i 's/lockPref(\"dom.disable_window_move_resize\".*/lockPref(\"dom.disable_window_move_resize\", true);/g' ${FIREFOX_DIR}/mozilla.cfg
    if ! [ $? -eq 0 ] ; then
      echo 'lockPref("dom.disable_window_move_resize", true);' >> ${FIREFOX_DIR}/mozilla.cfg
    fi
  fi
done
Disable JavaScript's Raise Or Lower Windows Capabilityxccdf_org.ssgproject.content_rule_firefox_preferences-javascript_window_changes mediumDISA FSO DTBF182

Disable JavaScript's Raise Or Lower Windows Capability

Rule IDxccdf_org.ssgproject.content_rule_firefox_preferences-javascript_window_changes
Result
fail
Time2017-02-16T11:42:18
Severitymedium
Identifiers and References

identifiers:  DISA FSO DTBF182

references:  ECSC-1, http://iase.disa.mil/cci/index.html

Description

JavaScript can configure and make changes to the web browser's appearance by specifically raising and lowering windows. This can be disabled by setting dom.disable_window_flip to true.

Rationale

JavaScript can make changes to the browser’s appearance. Allowing a website to use JavaScript to raise and lower browser windows may disguise an attack.

OVAL details

Items not found violating raise or lower windows is disabled:

Object oval:ssg:obj:179 of type textfilecontent54_object
PathFilenamePatternInstance
^\/usr\/(|local\/)lib(|64)\/firefox^.*\.cfg$^lockPref\("dom.disable_window_flip",[\s]+true\);$1
Remediation script:
FIREFOX_DIRs="/usr/lib/firefox /usr/lib64/firefox /usr/local/lib/firefox /usr/local/lib64/firefox"
for FIREFOX_DIR in ${FIREFOX_DIRs}; do
  if [ -d ${FIREFOX_DIR} ]; then
    grep -q '^lockPref(\"dom.disable_window_flip\", true);' ${FIREFOX_DIR}/mozilla.cfg && \
    sed -i 's/lockPref(\"dom.disable_window_flip\".*/lockPref(\"dom.disable_window_flip\", true);/g' ${FIREFOX_DIR}/mozilla.cfg
    if ! [ $? -eq 0 ] ; then
      echo 'lockPref("dom.disable_window_flip", true);' >> ${FIREFOX_DIR}/mozilla.cfg
    fi
  fi
done
Enable Non-Secure Page Warningsxccdf_org.ssgproject.content_rule_firefox_preferences-non-secure_page_warning mediumDISA FSO DTBF130

Enable Non-Secure Page Warnings

Rule IDxccdf_org.ssgproject.content_rule_firefox_preferences-non-secure_page_warning
Result
fail
Time2017-02-16T11:42:18
Severitymedium
Identifiers and References

identifiers:  DISA FSO DTBF130

references:  ECSC-1, http://iase.disa.mil/cci/index.html

Description

When users browse websites, web pages can switch in between secure and non-secure protocols. Users can be warned each time by setting security.warn_leaving_secure to true.

Rationale

Users may not be aware that the information being viewed under secure conditions in a previous page are not currently being viewed under the same security settings.

OVAL details

Items not found violating Check for non-secure page warning configured:

Object oval:ssg:obj:170 of type textfilecontent54_object
PathFilenamePatternInstance
^\/usr\/(|local\/)lib(|64)\/firefox^.*\.cfg$^lockPref\("security.warn_leaving_secure",[\s]+true\);$1
Remediation script:
FIREFOX_DIRs="/usr/lib/firefox /usr/lib64/firefox /usr/local/lib/firefox /usr/local/lib64/firefox"
for FIREFOX_DIR in ${FIREFOX_DIRs}; do
  if [ -d ${FIREFOX_DIR} ]; then
    grep -q '^lockPref(\"security.warn_leaving_secure\", true);' ${FIREFOX_DIR}/mozilla.cfg && \
    sed -i 's/lockPref(\"security.warn_leaving_secure\".*/lockPref(\"security.warn_leaving_secure\", true);/g' ${FIREFOX_DIR}/mozilla.cfg
    if ! [ $? -eq 0 ] ; then
      echo 'lockPref("security.warn_leaving_secure", true);' >> ${FIREFOX_DIR}/mozilla.cfg
    fi
  fi
done
Enable Firefox Pop-up Blockerxccdf_org.ssgproject.content_rule_firefox_preferences-pop-up_windows mediumDISA FSO DTBF180

Enable Firefox Pop-up Blocker

Rule IDxccdf_org.ssgproject.content_rule_firefox_preferences-pop-up_windows
Result
fail
Time2017-02-16T11:42:18
Severitymedium
Identifiers and References

identifiers:  DISA FSO DTBF180

references:  ECSC-1, http://iase.disa.mil/cci/index.html

Description

The pop-up blocker can be enabled by setting dom.disable_window_open_feature.status to true.

Rationale

Popup windows may be used to launch an attack within a new browser window with altered settings.

OVAL details

Items not found violating Check for pop-up_windows installed:

Object oval:ssg:obj:165 of type textfilecontent54_object
PathFilenamePatternInstance
^\/usr\/(|local\/)lib(|64)\/firefox^.*\.cfg$^lockPref\("dom.disable_window_open_feature.status",[\s]+true\);$1
Remediation script:
FIREFOX_DIRs="/usr/lib/firefox /usr/lib64/firefox /usr/local/lib/firefox /usr/local/lib64/firefox"
for FIREFOX_DIR in ${FIREFOX_DIRs}; do
  if [ -d ${FIREFOX_DIR} ]; then
    grep -q '^lockPref(\"dom.disable_window_open_feature.status\", true);' ${FIREFOX_DIR}/mozilla.cfg && \
    sed -i 's/lockPref(\"dom.disable_window_open_feature.status\".*/lockPref(\"dom.disable_window_open_feature.status\", true);/g' ${FIREFOX_DIR}/mozilla.cfg
    if ! [ $? -eq 0 ] ; then
      echo '^lockPref("dom.disable_window_open_feature.status", true);' >> ${FIREFOX_DIR}/mozilla.cfg
    fi
  fi
done
Disable Automatic Downloads of MIME Typesxccdf_org.ssgproject.content_rule_firefox_preferences-auto-download_actions mediumDISA FSO DTBF100

Disable Automatic Downloads of MIME Types

Rule IDxccdf_org.ssgproject.content_rule_firefox_preferences-auto-download_actions
Result
fail
Time2017-02-16T11:42:18
Severitymedium
Identifiers and References

identifiers:  DISA FSO DTBF100

references:  DCMC-1, http://iase.disa.mil/cci/index.html

Description

MIME type files are automatically downloaded or executed in Firefox. This can be disabled by setting browser.helperApps.alwaysAsk.force to true.

Rationale

The default action for file types for which a plugin is installed is to automatically download and execute the file using the associated plugin. Firefox allows users to change the specified download action so that the file is opened with a selected external application or saved to disk instead.

OVAL details

Items not found violating Check for Auto download Actions installed:

Object oval:ssg:obj:159 of type textfilecontent54_object
PathFilenamePatternInstance
^\/usr\/(|local\/)lib(|64)\/firefox^.*\.cfg$^lockPref\("browser.helperApps.alwaysAsk.force",[\s]+true\);$1
Remediation script:
FIREFOX_DIRs="/usr/lib/firefox /usr/lib64/firefox /usr/local/lib/firefox /usr/local/lib64/firefox"
for FIREFOX_DIR in ${FIREFOX_DIRs}; do
  if [ -d ${FIREFOX_DIR} ]; then
    grep -q '^lockPref(\"browser.helperApps.alwaysAsk.force\", true);' ${FIREFOX_DIR}/mozilla.cfg && \
    sed -i 's/lockPref(\"browser.helperApps.alwaysAsk.force\".*/lockPref(\"browser.helperApps.alwaysAsk.force\", true);/g' ${FIREFOX_DIR}/mozilla.cfg
    if ! [ $? -eq 0 ]; then
      echo 'lockPref("browser.helperApps.alwaysAsk.force", true);' >> ${FIREFOX_DIR}/mozilla.cfg
    fi
  fi
done
Red Hat and Red Hat Enterprise Linux are either registered trademarks or trademarks of Red Hat, Inc. in the United States and other countries. All other names are registered trademarks or trademarks of their respective companies.