SV-223163r612236: FireFox is not configured to block pop-up windows. | Mozilla Firefox Security Technical Implementation Guide

Loading benchmark…

Assessment Title

Rule Text

FireFox is not configured to block pop-up windows.

Description

Discussion Text

Popup windows may be used to launch an attack within a new browser window with altered settings. This setting blocks popup windows created while the page is loading.

How this relates to the STIG checklist: STIG vs SCAP benchmark.

IA Controls

NIST SP 800-53

Not mappedCCI-000381SV-16717V-15778

References

DPMS Target Mozilla Firefox DISA DPMS Target Mozilla Firefox 4097

SCC Automation Reference

The reconstructed evaluation script behind this rule's OVAL check(s) — every module a compound check combines, with this rule's own concrete values and DISA's SCC tool's real per-module mechanism curated from static teardown of SCC releases.

#!/bin/bash
# Reconstructed from oval:mil.disa.stig.mozilla.firefox.rhel:def:110
# FireFox is not configured to block pop-up windows.
# Per-module read mechanism curated from static teardown of DISA's SCC tool
# (SCAP Compliance Checker) -- see the SCC Automation Reference above.
#
# MANUAL REVIEW REQUIRED -- the module(s) below could not be reconstructed
# into working code from curated SCC reference data, and are excluded from
# the automated result:
#   - variable_object (variable_test) -- Verify there is only one installation of Mozilla Firefox: no extractor for field "value"
#   - textfilecontent54_object (textfilecontent54_test) -- Verify a javascript configuration file references a preferences file to lock settings defined therein: cannot derive an existence probe for this object type
#   - textfilecontent54_object (textfilecontent54_test) -- Verify the firefox preferences file starts with two forward slashes //: no extractor for field "text"
#   - textfilecontent54_object (textfilecontent54_test) -- Verify that a javascript configuration file sets general.config.obscure_value to 0: cannot derive an existence probe for this object type
#   - textfilecontent54_object (textfilecontent54_test) -- Verify that the preference name 'dom.disable_window_open_feature.status' is set to 'true' and locked.: no extractor for field "subexpression"

echo "MANUAL REVIEW REQUIRED -- see notes above; no part of this check could be automated"

Remediation

Ensure the preference  "dom.disable_window_open_feature.status "  is set and locked to the value of “true”.