Guide to the Secure Configuration for Firefox
with profile Upstream Firefox STIGThis profile is developed under the DoD consensus model and DISA FSO Vendor STIG process, serving as the upstream development environment for the Firefox STIG. As a result of the upstream/downstream relationship between the SCAP Security Guide project and the official DISA FSO STIG baseline, users should expect variance between SSG and DISA FSO content. For official DISA FSO STIG content, refer to http://iase.disa.mil/stigs/app-security/browser-guidance/Pages/index.aspx. While this profile is packaged by Red Hat as part of the SCAP Security Guide package, please note that commercial support of this SCAP content is NOT available. This profile is provided as example SCAP content with no endorsement for suitability or production readiness. Support for this profile is provided by the upstream SCAP Security Guide community on a best-effort basis. The upstream project homepage is https://fedorahosted.org/scap-security-guide/.
Providing system administrators with such guidance informs them how to securely configure systems under their control in a variety of network roles. Policy makers and baseline creators can use this catalog of settings, with its associated references to higher-level security control catalogs, in order to assist them in security baseline creation. This guide is a catalog, not a checklist, and satisfaction of every item is not likely to be possible or sensible in many operational scenarios. However, the XCCDF format enables granular selection and adjustment of settings, and their association with OVAL and OCIL content provides an automated checking capability. Transformations of this document, and its associated automated checking content, are capable of providing baselines that meet a diverse set of policy objectives. Some example XCCDF Profiles, which are selections of items that form checklists and can be used as baselines, are available with this guide. They can be processed, in an automated fashion, with tools that support the Security Content Automation Protocol (SCAP). The DISA STIG for RHEL 6 is one example of a baseline created from this guidance.
Evaluation Characteristics
Target machine | shore-patrol.example.com |
---|---|
Benchmark URL | /var/lib/openscap/content/0f75f9637bc46d0ab685b05ada9a8bd3ba55a9a6d083c9852e8235a3b7cd1d26.xml |
Benchmark ID | xccdf_org.ssgproject.content_benchmark_Firefox |
Profile ID | xccdf_org.ssgproject.content_profile_stig-firefox-upstream |
Started at | 2017-02-16T11:42:18 |
Finished at | 2017-02-16T11:42:18 |
Performed by | root |
CPE Platforms
- cpe:/a:mozilla:firefox
Addresses
- IPv4 127.0.0.1
- IPv4 192.168.100.107
- IPv6 0:0:0:0:0:0:0:1
- IPv6 fe80:0:0:0:5054:ff:feba:8397
- MAC 00:00:00:00:00:00
- MAC 52:54:00:BA:83:97
Compliance and Scoring
Rule results
Severity of failed rules
Score
Scoring system | Score | Maximum | Percent |
---|---|---|---|
urn:xccdf:scoring:default | 4.166667 | 100.000000 |
Rule Overview
Result Details
Disable Firefox Configuration File ROT-13 Encoding
Rule ID | xccdf_org.ssgproject.content_rule_firefox_preferences-lock_settings_obscure | ||||||||
Result | fail | ||||||||
Time | 2017-02-16T11:42:18 | ||||||||
Severity | medium | ||||||||
Identifiers and References | identifiers: DISA FSO DTBF070 references: ECSC-1, http://iase.disa.mil/cci/index.html | ||||||||
Description |
Disable ROT-13 encoding by setting | ||||||||
Rationale | ROT-13 encoded prevents system adminstrators from easily configuring and deploying Firefox configuration settings. It also prevents validating settings easily from automated security tools. | ||||||||
OVAL details Items not found violating Check for obscure_value:Object oval:ssg:obj:162 of type textfilecontent54_object
| |||||||||
Remediation script:
|
Set Firefox Configuration File Location
Rule ID | xccdf_org.ssgproject.content_rule_firefox_preferences-lock_settings_config_file | ||||||||
Result | fail | ||||||||
Time | 2017-02-16T11:42:18 | ||||||||
Severity | medium | ||||||||
Identifiers and References | identifiers: DISA FSO DTBF070 references: ECSC-1, http://iase.disa.mil/cci/index.html | ||||||||
Description |
Specify the Firefox configuration file location by setting
| ||||||||
Rationale | Locked settings prevents users from accessing about:config and changing the security settings set by the system administrator. | ||||||||
OVAL details Items not found violating Check for configuration filename:Object oval:ssg:obj:167 of type textfilecontent54_object
| |||||||||
Remediation script:
|
Enable Shared System Certificates
Rule ID | xccdf_org.ssgproject.content_rule_firefox_preferences-enable_ca_trust |
Result | notchecked |
Time | 2017-02-16T11:42:18 |
Severity | medium |
Identifiers and References | identifiers: CCE-27457-1 |
Description | The Shared System Certificates store makes NSS, GnuTLS, OpenSSL, and Java share a default source for retrieving system certificate anchors and blacklist information. Firefox has the capability of using this centralized store for its CA certificates. If the Shared System Certificates store is disabled, it can be enabled by running the following command: $ sudo update-ca-trust enable |
Rationale | The DOD root certificate will ensure that the trust chain is established for server certificates issued from the DOD CA. |
The DoD Root Certificate Exists
Rule ID | xccdf_org.ssgproject.content_rule_firefox_preferences-dod_root_certificate_installed |
Result | notchecked |
Time | 2017-02-16T11:42:18 |
Severity | medium |
Identifiers and References | identifiers: CCE-27457-1 |
Description |
The DoD root certificate should be installed in the Shared System Certificates store
for Firefox to be able to access the DoD certificate. To install the root certificated
into the Shared System Certificates store, copy the DoD root certificate into
$ sudo update-ca-trust extract |
Rationale | The DOD root certificate will ensure that the trust chain is established for server certificates issued from the DOD CA. |
Disable Addons Plugin Updates
Rule ID | xccdf_org.ssgproject.content_rule_firefox_preferences-addons_plugin_updates | ||||||||
Result | fail | ||||||||
Time | 2017-02-16T11:42:18 | ||||||||
Severity | medium | ||||||||
Identifiers and References | identifiers: DISA FSO DTBF090 references: ECSC-1, http://iase.disa.mil/cci/index.html | ||||||||
Description |
Firefox automatically updates installed add-ons and plugins which
can be disabled by setting | ||||||||
Rationale | Automatic updates from untrusted sites puts the enclave at risk of attack and may override security settings. | ||||||||
OVAL details Items not found violating Check for addons plugin updates:Object oval:ssg:obj:174 of type textfilecontent54_object
| |||||||||
Remediation script:
|
Disable Autofill Form Assistance
Rule ID | xccdf_org.ssgproject.content_rule_firefox_preferences-autofill_forms | ||||||||
Result | fail | ||||||||
Time | 2017-02-16T11:42:18 | ||||||||
Severity | medium | ||||||||
Identifiers and References | identifiers: DISA FSO DTBF140 references: ECSC-1, http://iase.disa.mil/cci/index.html | ||||||||
Description |
Firefox provides tools to auto-fill forms from prefilled information.
This can be disabled by setting | ||||||||
Rationale | In order to protect privacy and sensitive data, Firefox provides the ability to configure Firefox such that data entered into forms is not saved. This mitigates the risk of a website gleaning private information from prefilled information. | ||||||||
OVAL details Items not found violating Check for autofill_forms disabled:Object oval:ssg:obj:166 of type textfilecontent54_object
| |||||||||
Remediation script:
|
Disable User Ability To Autofill Passwords
Rule ID | xccdf_org.ssgproject.content_rule_firefox_preferences-autofill_passwords | ||||||||
Result | fail | ||||||||
Time | 2017-02-16T11:42:18 | ||||||||
Severity | medium | ||||||||
Identifiers and References | identifiers: DISA FSO DTBF150 references: ECSC-1, http://iase.disa.mil/cci/index.html | ||||||||
Description |
Firefox automatically allows users to save passwords to be auto-filled
into password forms. This can be disabled by setting
| ||||||||
Rationale | While on the internet, it may be possible for an attacker to view the saved password files and gain access to the user's accounts on various hosts. | ||||||||
OVAL details Items not found violating Check for autofill_passwords disabled:Object oval:ssg:obj:160 of type textfilecontent54_object
| |||||||||
Remediation script:
|
Disable Firefox Auto-Update Capability
Rule ID | xccdf_org.ssgproject.content_rule_firefox_preferences-auto-update_of_firefox | ||||||||
Result | fail | ||||||||
Time | 2017-02-16T11:42:18 | ||||||||
Severity | medium | ||||||||
Identifiers and References | identifiers: DISA FSO DTBF080 references: ECSC-1, http://iase.disa.mil/cci/index.html | ||||||||
Description |
Firefox can be set to automatically update as new updates. This can be
disabled by setting | ||||||||
Rationale | Allowing software updates from non-trusted sites can introduce settings that will override a secured installation of the application. This can place DoD information at risk. If this setting is enabled, then there are many other default settings which point to untrusted sites which must be changed to point to an authorized update site that is not publicly accessible. | ||||||||
OVAL details Items not found violating Check that auto-update of firefox is disabled:Object oval:ssg:obj:158 of type textfilecontent54_object
| |||||||||
Remediation script:
|
Enable Downloading and Opening File Confirmation
Rule ID | xccdf_org.ssgproject.content_rule_firefox_preferences-open_confirmation | ||||||||||
Result | fail | ||||||||||
Time | 2017-02-16T11:42:18 | ||||||||||
Severity | medium | ||||||||||
Identifiers and References | identifiers: DISA FSO DTBF110 references: ECSC-1, http://iase.disa.mil/cci/index.html | ||||||||||
Description |
To have an action dialog box appear promping users what action to take when
certain types of files are downloaded or opened, set
| ||||||||||
Rationale | When the user receives a dialog box asking if they want to save the file or open it with a specified application, this indicates that a plugin does not exist. Also, the user has not previously selected a download action or helper application to automatically use for that type of file. When prompted, if the user checks the option to 'Do this automatically for files like this from now on', then an entry will appear for that type of file in the plugins listing, and this file type is automatically opened in the future. This can be a security issue. New file types cannot be added directly to the Application plugin listing. | ||||||||||
OVAL details Items not found violating Check for open_confirmation configured:Object oval:ssg:obj:168 of type textfilecontent54_object
State oval:ssg:ste:169 of type textfilecontent54_state
| |||||||||||
Remediation script:
|
Disable the Firefox Password Store
Rule ID | xccdf_org.ssgproject.content_rule_firefox_preferences-password_store | ||||||||
Result | fail | ||||||||
Time | 2017-02-16T11:42:18 | ||||||||
Severity | medium | ||||||||
Identifiers and References | identifiers: DISA FSO DTBF160 references: ECSC-1, http://iase.disa.mil/cci/index.html | ||||||||
Description |
Firefox allows users to store passwords whether or not a master password
is set for the password store. To disable the storing of passwords, set
| ||||||||
Rationale | Autofill of a password can be enabled when a site is visited. This feature could also be used to autofill the certificate pin which could lead to compromise of DoD information. | ||||||||
OVAL details Items not found violating Check that the password_store is disabled:Object oval:ssg:obj:177 of type textfilecontent54_object
| |||||||||
Remediation script:
|
Disable Installed Search Plugins Update Checking
Rule ID | xccdf_org.ssgproject.content_rule_firefox_preferences-search_update | ||||||||
Result | fail | ||||||||
Time | 2017-02-16T11:42:18 | ||||||||
Severity | medium | ||||||||
Identifiers and References | identifiers: DISA FSO DTBF085 references: ECSC-1, http://iase.disa.mil/cci/index.html | ||||||||
Description |
Firefox automatically checks for updated versions of search plugins.
To disable the automatic updates of plugins, set
| ||||||||
Rationale | Updates need to be controlled and installed from authorized and trusted servers. This setting overrides a number of other settings which may direct the application to access external URLs. | ||||||||
OVAL details Items not found violating Check search plugin update capability is disabled:Object oval:ssg:obj:176 of type textfilecontent54_object
| |||||||||
Remediation script:
|
Disable Firefox Access to Shell Protocols
Rule ID | xccdf_org.ssgproject.content_rule_firefox_preferences-shell_protocol | ||||||||
Result | fail | ||||||||
Time | 2017-02-16T11:42:18 | ||||||||
Severity | medium | ||||||||
Identifiers and References | identifiers: DISA FSO DTBF105 references: ECSC-1, http://iase.disa.mil/cci/index.html | ||||||||
Description |
Access to the shell is disabled by default but can be changed.
To prevent shell access from being enabled, set
| ||||||||
Rationale | If enabled, this setting would allow the browser to access the Windows shell. This could allow access to the underlying system. | ||||||||
OVAL details Items not found violating Check that the hell_protocol is disabled:Object oval:ssg:obj:175 of type textfilecontent54_object
| |||||||||
Remediation script:
|
Disable SSL Version 2.0 in Firefox
Rule ID | xccdf_org.ssgproject.content_rule_firefox_preferences-ssl_version_2 | ||||||||
Result | fail | ||||||||
Time | 2017-02-16T11:42:18 | ||||||||
Severity | medium | ||||||||
Identifiers and References | identifiers: DISA FSO DTBF010 references: ECSC-1, http://iase.disa.mil/cci/index.html | ||||||||
Description |
SSL version 2 is not enabled by default and should not be enabled.
To prevent SSL version 2 from being enabled set
| ||||||||
Rationale | Use of versions prior to TLS 1.0 are not permitted because these versions are non-standard. SSL 2.0 and SSL 3.0 contain a number of security flaws. | ||||||||
OVAL details Items not found violating Check SSL 2.0 protocol disabled:Object oval:ssg:obj:171 of type textfilecontent54_object
| |||||||||
Remediation script:
|
Enable TLS Usage in Firefox
Rule ID | xccdf_org.ssgproject.content_rule_firefox_preferences-ssl_protocol_tls | ||||||||
Result | fail | ||||||||
Time | 2017-02-16T11:42:18 | ||||||||
Severity | medium | ||||||||
Identifiers and References | identifiers: DISA FSO DTBF030 references: ECSC-1, http://iase.disa.mil/cci/index.html | ||||||||
Description |
To enable TLS, set | ||||||||
Rationale | Earlier versions of SSL have known security vulnerabilities and are not authorized for use in DOD environments. | ||||||||
OVAL details Items not found violating Check if TLS is enabled:Object oval:ssg:obj:172 of type textfilecontent54_object
| |||||||||
Remediation script:
|
Enable Certificate Verification
Rule ID | xccdf_org.ssgproject.content_rule_firefox_preferences-verification | ||||||||
Result | fail | ||||||||
Time | 2017-02-16T11:42:18 | ||||||||
Severity | medium | ||||||||
Identifiers and References | identifiers: DISA FSO DTBF050 references: ECSC-1, http://iase.disa.mil/cci/index.html | ||||||||
Description |
Firefox can be configured to prompt the user to choose a certificate
to present to a website when asked. To enable certificate verification,
set | ||||||||
Rationale | Websites within DoD require user authentication for access which increases security for DoD information. Access will be denied to the user if certificate management is not configured. | ||||||||
OVAL details Items not found violating Enable Certification verification:Object oval:ssg:obj:161 of type textfilecontent54_object
| |||||||||
Remediation script:
|
Disable SSL Version 3.0 in Firefox
Rule ID | xccdf_org.ssgproject.content_rule_firefox_preferences-ssl_version_3 | ||||||||
Result | fail | ||||||||
Time | 2017-02-16T11:42:18 | ||||||||
Severity | medium | ||||||||
Identifiers and References | identifiers: DISA FSO DTBF020 references: ECSC-1, http://iase.disa.mil/cci/index.html | ||||||||
Description |
SSL version 3.0 is vulnerable and should be disabled by setting
| ||||||||
Rationale | Earlier versions of SSL have known security vulnerabilities and are not authorized for use in DOD. | ||||||||
OVAL details Items not found violating Check for SSL Version 3 preferences:Object oval:ssg:obj:178 of type textfilecontent54_object
| |||||||||
Remediation script:
|
Default Firefox Home Page Configured
Rule ID | xccdf_org.ssgproject.content_rule_firefox_preferences-home_page | ||||||||||
Result | fail | ||||||||||
Time | 2017-02-16T11:42:18 | ||||||||||
Severity | medium | ||||||||||
Identifiers and References | identifiers: DISA FSO DTBF017 references: ECSC-1, http://iase.disa.mil/cci/index.html | ||||||||||
Description |
The default home page is set to a vendor's defined website or
Firefox's own website. This can be changed to an organizationally defined website
or | ||||||||||
Rationale | The browser home page parameter specifies the web page that is to be displayed when the browser is started explicitly and when product-specific buttons or key sequences for the home page are accessed. This helps to mitigate the possibility of automatic inadvertent execution of scripts added to a previously safe site. | ||||||||||
OVAL details Items not found violating Check for home page configured:Object oval:ssg:obj:163 of type textfilecontent54_object
State oval:ssg:ste:164 of type textfilecontent54_state
| |||||||||||
Remediation script:
|
Supported Version of Firefox Installed
Rule ID | xccdf_org.ssgproject.content_rule_installed_firefox_version_supported | ||||||||||||||||
Result | pass | ||||||||||||||||
Time | 2017-02-16T11:42:18 | ||||||||||||||||
Severity | high | ||||||||||||||||
Identifiers and References | identifiers: DISA FSO DTBF003 references: DCMC-1, http://iase.disa.mil/cci/index.html | ||||||||||||||||
Description | If the system is joined to the Red Hat Network, a Red Hat Satellite Server, or a yum server, run the following command to install updates: $ sudo yum updateIf the system is not configured to use one of these sources, updates (in the form of RPM packages) can be manually downloaded and installed using rpm .
| ||||||||||||||||
Rationale | Use of versions of an application which are not supported by the vendor are not permitted. Vendors respond to security flaws with updates and patches. These updates are not available for unsupported version which can leave the application vulnerable to attack. | ||||||||||||||||
OVAL details Items found satisfying Installed version of firefox is greater than ESR 31.5:
|
Disable JavaScript's Moving Or Resizing Windows Capability
Rule ID | xccdf_org.ssgproject.content_rule_firefox_preferences-javascript_window_resizing | ||||||||
Result | fail | ||||||||
Time | 2017-02-16T11:42:18 | ||||||||
Severity | medium | ||||||||
Identifiers and References | identifiers: DISA FSO DTBF181 references: ECSC-1, http://iase.disa.mil/cci/index.html | ||||||||
Description |
JavaScript can configure and make changes to the web browser's appearance by
specifically moving and resizing browser windows. This can be disabled by
setting | ||||||||
Rationale | JavaScript can make changes to the browser’s appearance. This activity can help disguise an attack taking place in a minimized background window. | ||||||||
OVAL details Items not found violating Check for move or resize windows disabled:Object oval:ssg:obj:184 of type textfilecontent54_object
| |||||||||
Remediation script:
|
Disable JavaScript's Raise Or Lower Windows Capability
Rule ID | xccdf_org.ssgproject.content_rule_firefox_preferences-javascript_window_changes | ||||||||
Result | fail | ||||||||
Time | 2017-02-16T11:42:18 | ||||||||
Severity | medium | ||||||||
Identifiers and References | identifiers: DISA FSO DTBF182 references: ECSC-1, http://iase.disa.mil/cci/index.html | ||||||||
Description |
JavaScript can configure and make changes to the web browser's appearance by
specifically raising and lowering windows. This can be disabled by
setting | ||||||||
Rationale | JavaScript can make changes to the browser’s appearance. Allowing a website to use JavaScript to raise and lower browser windows may disguise an attack. | ||||||||
OVAL details Items not found violating raise or lower windows is disabled:Object oval:ssg:obj:179 of type textfilecontent54_object
| |||||||||
Remediation script:
|
Enable Non-Secure Page Warnings
Rule ID | xccdf_org.ssgproject.content_rule_firefox_preferences-non-secure_page_warning | ||||||||
Result | fail | ||||||||
Time | 2017-02-16T11:42:18 | ||||||||
Severity | medium | ||||||||
Identifiers and References | identifiers: DISA FSO DTBF130 references: ECSC-1, http://iase.disa.mil/cci/index.html | ||||||||
Description |
When users browse websites, web pages can switch in between secure and
non-secure protocols. Users can be warned each time by
setting | ||||||||
Rationale | Users may not be aware that the information being viewed under secure conditions in a previous page are not currently being viewed under the same security settings. | ||||||||
OVAL details Items not found violating Check for non-secure page warning configured:Object oval:ssg:obj:170 of type textfilecontent54_object
| |||||||||
Remediation script:
|
Enable Firefox Pop-up Blocker
Rule ID | xccdf_org.ssgproject.content_rule_firefox_preferences-pop-up_windows | ||||||||
Result | fail | ||||||||
Time | 2017-02-16T11:42:18 | ||||||||
Severity | medium | ||||||||
Identifiers and References | identifiers: DISA FSO DTBF180 references: ECSC-1, http://iase.disa.mil/cci/index.html | ||||||||
Description |
The pop-up blocker can be enabled by setting
| ||||||||
Rationale | Popup windows may be used to launch an attack within a new browser window with altered settings. | ||||||||
OVAL details Items not found violating Check for pop-up_windows installed:Object oval:ssg:obj:165 of type textfilecontent54_object
| |||||||||
Remediation script:
|
Disable Automatic Downloads of MIME Types
Rule ID | xccdf_org.ssgproject.content_rule_firefox_preferences-auto-download_actions | ||||||||
Result | fail | ||||||||
Time | 2017-02-16T11:42:18 | ||||||||
Severity | medium | ||||||||
Identifiers and References | identifiers: DISA FSO DTBF100 references: DCMC-1, http://iase.disa.mil/cci/index.html | ||||||||
Description |
MIME type files are automatically downloaded or executed in Firefox. This
can be disabled by setting | ||||||||
Rationale | The default action for file types for which a plugin is installed is to automatically download and execute the file using the associated plugin. Firefox allows users to change the specified download action so that the file is opened with a selected external application or saved to disk instead. | ||||||||
OVAL details Items not found violating Check for Auto download Actions installed:Object oval:ssg:obj:159 of type textfilecontent54_object
| |||||||||
Remediation script:
|