CVE-2014-1539

Vulnerability

In Mozilla Firefox before version 30.0 and Thunderbird through version 24.6 on OS X, the cursor can become invisible after interaction with a Flash object and a DIV element. The browser fails to ensure cursor visibility following Flash use, allowing a remote attacker to manipulate the cursor appearance. This issue is specific to OS X and does not affect Windows or Linux systems [3].

Exploitation

An attacker can craft a web page containing a Flash object and a DIV element. By using JavaScript, the attacker creates a fake cursor image that mimics the real cursor. The user must first interact with the Flash object (e.g., click on it), then move the cursor over the DIV, where it becomes invisible. The fake cursor image can then be repositioned to trick the user into clicking on a different element than intended. No authentication is required, but user interaction with the Flash object is necessary [2][3].

Impact

Successful exploitation allows clickjacking attacks: the user perceives they are clicking on one element (the fake cursor) but actually interacts with a different, potentially hidden element. This can lead to unintended actions such as changing security settings, making purchases, or other malicious operations. The impact is high, as it compromises the integrity of user interactions and can lead to further compromise [3].

Mitigation

Firefox 30 and later versions are fixed; users should upgrade to at least Firefox 30 [3]. Thunderbird users should upgrade to a version beyond 24.6; the advisory indicates the fix is included in later releases (e.g., Thunderbird 31.5.0 in Gentoo) [1]. No workarounds are available. This vulnerability is specific to OS X, and users on other platforms are not affected [3].