Firefox application is set to auto-update.

From Mozilla Firefox Security Technical Implementation Guide

Part of DTBF080 - Firefox Preferences – Auto-update of Firefox

Associated with: CCI-000381

SV-21887r3_rule Firefox application is set to auto-update.

Vulnerability discussion

Allowing software updates from non-trusted sites can introduce settings that will override a secured installation of the application. This can place DoD information at risk. If this setting is enabled, then there are many other default settings which point to untrusted sites which must be changed to point to an authorized update site that is not publicly accessible.

Check content

Type "about:config" in the browser window. Verify that: 1. The preference name "app.update.enabled" is set to ”true” and locked. 2. Verify that "app.update.url", "app.update.url.details", and "app.update.url.manual" contain url information that point to a trusted internal server or the default setting of “Mozilla.com” or “Mozilla.org”. Criteria: If the parameter is set incorrectly, this is a finding. If this setting is not locked, this is a finding.

Fix text

Ensure the preference "app.update.enable" is set and locked to the value of “True” or that a trusted server is used.

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.