What changed in Mozilla Firefox Security Technical Implementation Guide V5R3V5R3 changes

Check text

AND - Verify there is only one installation of Mozilla Firefox variable_test (check: all, existence: at_least_one_exists) object variable_object: var_ref equals "oval:mil.disa.stig.mozilla.firefox.rhel:var:50" state variable_state: value equals "1" - Verify a javascript configuration file references a preferences file to lock settings defined therein textfilecontent54_test (check: all, existence: ) object textfilecontent54_object: pattern pattern match "^\\s*pref\\(\"general\\.config\\.filename\"\\s*,\\s*\"(\\S+)\"\\s*\\)\\s*;"; path equals ""; filename pattern match "\\.js$"; instance greater than or equal "1" - Verify the firefox preferences file starts with two forward slashes // textfilecontent54_test (check: all, existence: ) object textfilecontent54_object: pattern pattern match ".*"; path equals ""; filename equals ""; instance equals "1"; behaviors equals "" state textfilecontent54_state: text pattern match "^//" - Verify that a javascript configuration file sets general.config.obscure_value to 0 textfilecontent54_test (check: all, existence: ) object textfilecontent54_object: pattern pattern match "^\\s*pref\\(\\s*\"general\\.config\\.obscure_value\"\\s*,\\s*0\\s*\\)\\s*;"; path equals ""; filename pattern match "\\.js$"; instance equals "1" - Verify that the preference name 'xpinstall.enabled' is set to 'false' and locked. textfilecontent54_test (check: all, existence: ) object textfilecontent54_object: pattern pattern match "^lockPref\\(\"xpinstall\\.enabled\"\\s*,\\s*(.+)\\);"; path equals ""; filename equals ""; instance equals "1" state textfilecontent54_state: subexpression equals "false" Open a browser window, type "about:config" in the address bar, then navigate to the setting for Preference Name "xpinstall.enabled" and set the value to “false” and locked. Criteria: If the value of “xpinstall.enabled” is “false”, this is not a finding. If the value is locked, this is not a finding. If the SA can show that “DisableSystemAddonUpdate” policy is used instead, and set to “1”, this is not a finding.

V-223167 in V5R3

Check text

AND - Verify there is only one installation of Mozilla Firefox variable_test (check: all, existence: at_least_one_exists) object variable_object: var_ref equals "oval:mil.disa.stig.mozilla.firefox.rhel:var:50" state variable_state: value equals "1" - Verify a javascript configuration file references a preferences file to lock settings defined therein textfilecontent54_test (check: all, existence: ) object textfilecontent54_object: pattern pattern match "^\\s*pref\\(\"general\\.config\\.filename\"\\s*,\\s*\"(\\S+)\"\\s*\\)\\s*;"; path equals ""; filename pattern match "\\.js$"; instance greater than or equal "1" - Verify the firefox preferences file starts with two forward slashes // textfilecontent54_test (check: all, existence: ) object textfilecontent54_object: pattern pattern match ".*"; path equals ""; filename equals ""; instance equals "1"; behaviors equals "" state textfilecontent54_state: text pattern match "^//" - Verify that a javascript configuration file sets general.config.obscure_value to 0 textfilecontent54_test (check: all, existence: ) object textfilecontent54_object: pattern pattern match "^\\s*pref\\(\\s*\"general\\.config\\.obscure_value\"\\s*,\\s*0\\s*\\)\\s*;"; path equals ""; filename pattern match "\\.js$"; instance equals "1" - Verify that the preference name 'devtools.policy.disabled' is set to 'true' and locked. textfilecontent54_test (check: all, existence: ) object textfilecontent54_object: pattern pattern match "^\\s*lockPref\\(\\s*\"devtools\\.policy\\.disabled\"\\s*,\\s*(.+)\\s*\\)\\s*;"; path equals ""; filename equals ""; instance greater than or equal "1" state textfilecontent54_state: subexpression equals "true" Procedure: Open a browser window, type "about:config" in the address bar. Criteria: If the value of "devtools.policy.disabled" is not "true", then this is a finding.

Fix text

Set the value of "devtools.policy.disabled" to "true" using the Mozilla.cfg file, or the registry value of HKLM\Software\Policies\Mozilla\Firefox\DisableDeveloperTools to “1”.

V-223169 in V5R3