SV-251549r960963: Firefox must be configured to not automatically update installed add-ons and plugins. | Mozilla Firefox for Linux STIG SCAP Benchmark

Loading benchmark…

Assessment Title

Rule Text

Firefox must be configured to not automatically update installed add-ons and plugins.

Description

Discussion Text

Set this to false to disable checking for updated versions of the Extensions/Themes. Automatic updates from untrusted sites puts the enclave at risk of attack and may override security settings.

How this relates to the STIG checklist: STIG vs SCAP benchmark.

IA Controls

NIST SP 800-53

Not mappedCCI-000381

References

DPMS Target Mozilla Firefox 2021 VERSION DISA DPMS Target Mozilla Firefox 2021 VERSION 5446

Checks

DISA STIG (Manual Reference)

Type "about:policies" in the browser window.

If "ExtensionUpdate" is not displayed under Policy Name or the Policy Value is not "false", this is a finding.

SCC Automation Reference

The reconstructed evaluation script behind this rule's OVAL check(s) — every module a compound check combines, with this rule's own concrete values and DISA's SCC tool's real per-module mechanism curated from static teardown of SCC releases.

Assessment Script Powered by AISandbox-executed

A standalone Shell script to assess this control automatically. Review before running it in your environment.

Syntax-checked and actually executed in an isolated sandbox (not the real system this checks) — confirmed to run without errors.

#!/bin/sh
# OVAL definition: oval:mil.disa.stig.firefox.linux:def:104

# Check if policies.json exists
if [ ! -f "policies.json" ]; then
    echo "PASS"
    exit 0
fi

# Extract ExtensionUpdate value from policies.json
extension_update=$(grep -oP '"ExtensionUpdate": \Kfalse' policies.json)

# Check if ExtensionUpdate is false
if [ "$extension_update" = "false" ]; then
    echo "PASS"
    exit 0
else
    echo "FAIL"
    exit 1
fi

Remediation

Windows group policy:
1. Open the group policy editor tool with "gpedit.msc".
2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Mozilla\Firefox\Extensions
Policy Name: Extension Update
Policy State: Disabled

macOS "plist" file:
Add the following:
<key>ExtensionUpdate</key>
<false/>

Linux "policies.json" file:
Add the following in the policies section:
"ExtensionUpdate": false