Firefox application is set to auto-update.

From Mozilla Firefox Security Technical Implementation Guide

Part of DTBF080-Firefox Preferences–Auto-update of Firefox

SV-21887r2_rule Firefox application is set to auto-update.

Vulnerability discussion

Allowing software updates from non-trusted sites can introduce settings that will override a secured installation of the application. This can place DoD information at risk. If this setting is enabled, then there are many other default settings which point to untrusted sites which must be changed to point to an authorized update site that is not publicly accessible.

Check content

Type "about:config" in the browser window. Verify that 1. The preference name "app.update.enabled" is set to 'false' and locked or 2. If set to "true" then verify that "app.update.url", "app.update.url.details" and "app.update.url.manual" contain url information that point to a trusted server and is not the default setting. (Default would contain mozilla.com or Mozilla.org). Criteria: If the parameter is set incorrectly, then this is a finding. If this setting is not locked, then this is a finding.

Fix text

Ensure the preference "app.update.enable" is set and locked to the value of “False” or that a trusted server is used.

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.