CVE-2011-2486 (published 2012-11-19T12:10Z)

nspluginwrapper before 1.4.4 does not properly provide access to NPNVprivateModeBool variable settings, which could prevent Firefox plugins from determining if they should run in Private Browsing mode and allow remote attackers to bypass intended access restrictions, as demonstrated using Flash.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:N/I:P/A:N)

Weakness information:
cwe_id: CWE-264
cwe_name: Permissions, Privileges, and Access Controls
description: Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.

Fix information:
repo_url: https://github.com/davidben/nspluginwrapper
commit_details: repo_url: https://github.com/davidben/nspluginwrapper
author: David Benjamin
author_date: 2011-03-25 18:52:42-04:00
msg: Support all the new variables added
repository: repo_url: https://github.com/davidben/nspluginwrapper
repo_name: davidben/nspluginwrapper
description: A cross-platform NPAPI plugin viewer
repo_language: C
owner: davidben
file_changes: filename: npw-rpc.c
change_type: ModificationType.MODIFY
diff: @@ -41,6 +41,8 @@ int rpc_type_of_NPNVariable(int variable)
   case NPNVisOfflineBool:
   case NPNVSupportsXEmbedBool:
   case NPNVSupportsWindowless:
+  case NPNVprivateModeBool:
+  case NPNVsupportsAdvancedKeyHandling:
 	type = RPC_TYPE_BOOLEAN;
 	break;
   case NPNVToolkit:
@@ -65,6 +67,7 @@ int rpc_type_of_NPPVariable(int variable)
   case NPPVpluginNameString:
   case NPPVpluginDescriptionString:
   case NPPVformValue: // byte values of 0 does not appear in the UTF-8 encoding but for U+0000
+  case NPPVpluginNativeAccessibleAtkPlugId:
 	type = RPC_TYPE_STRING;
 	break;
   case NPPVpluginWindowSize:
@@ -76,6 +79,10 @@ int rpc_type_of_NPPVariable(int variable)
   case NPPVpluginTransparentBool:
   case NPPVjavascriptPushCallerBool:
   case NPPVpluginKeepLibraryInMemory:
+  case NPPVpluginUrlRequestsDisplayedBool:
+  case NPPVpluginWantsAllNetworkStreams:
+  case NPPVpluginCancelSrcStream:
+  case NPPVSupportsAdvancedKeyHandling:
 	type = RPC_TYPE_BOOLEAN;
 	break;
   case NPPVpluginScriptableNPObject:

programming_language: C++
filename: npw-viewer.c
change_type: ModificationType.MODIFY
diff: @@ -1302,6 +1302,8 @@ g_NPN_GetValue(NPP instance, NPNVariable variable, void *value)
   case NPNVSupportsXEmbedBool:
   case NPNVWindowNPObject:
   case NPNVPluginElementNPObject:
+  case NPNVprivateModeBool:
+  case NPNVsupportsAdvancedKeyHandling:
 	return g_NPN_GetValue_real(instance, variable, value);
   default:
 	switch (variable & 0xff) {

programming_language: C
filename: utils.c
change_type: ModificationType.MODIFY
diff: @@ -247,6 +247,11 @@ const char *string_of_NPPVariable(int variable)
 	_(NPPVpluginNeedsXEmbed);
 	_(NPPVpluginScriptableNPObject);
 	_(NPPVformValue);
+	_(NPPVpluginUrlRequestsDisplayedBool);
+	_(NPPVpluginWantsAllNetworkStreams);
+	_(NPPVpluginNativeAccessibleAtkPlugId);
+	_(NPPVpluginCancelSrcStream);
+	_(NPPVSupportsAdvancedKeyHandling);
 #undef _
   default:
 	switch (variable & 0xff) {
@@ -283,6 +288,8 @@ const char *string_of_NPNVariable(int variable)
 	_(NPNVWindowNPObject);
 	_(NPNVPluginElementNPObject);
 	_(NPNVSupportsWindowless);
+	_(NPNVprivateModeBool);
+	_(NPNVsupportsAdvancedKeyHandling);
 #undef _
   default:
 	switch (variable & 0xff) {

programming_language: C++