SV-223164r612236: FireFox is configured to allow JavaScript to move or resize windows. | Mozilla Firefox Security Technical Implementation Guide

Loading benchmark…

Assessment Title

Rule Text

FireFox is configured to allow JavaScript to move or resize windows.

Description

Discussion Text

JavaScript can make changes to the browser’s appearance. This activity can help disguise an attack taking place in a minimized background window. Set browser setting to prevent scripts on visited websites from moving and resizing browser windows.

How this relates to the STIG checklist: STIG vs SCAP benchmark.

IA Controls

NIST SP 800-53

Not mappedCCI-000381SV-16718V-15779

References

DPMS Target Mozilla Firefox DISA DPMS Target Mozilla Firefox 4097

SCC Automation Reference

The reconstructed evaluation script behind this rule's OVAL check(s) — every module a compound check combines, with this rule's own concrete values and DISA's SCC tool's real per-module mechanism curated from static teardown of SCC releases.

#!/bin/bash
# Reconstructed from oval:mil.disa.stig.mozilla.firefox.rhel:def:120
# FireFox is configured to allow JavaScript to move or resize windows.
# Per-module read mechanism curated from static teardown of DISA's SCC tool
# (SCAP Compliance Checker) -- see the SCC Automation Reference above.
#
# MANUAL REVIEW REQUIRED -- the module(s) below could not be reconstructed
# into working code from curated SCC reference data, and are excluded from
# the automated result:
#   - variable_object (variable_test) -- Verify there is only one installation of Mozilla Firefox: no extractor for field "value"
#   - textfilecontent54_object (textfilecontent54_test) -- Verify a javascript configuration file references a preferences file to lock settings defined therein: cannot derive an existence probe for this object type
#   - textfilecontent54_object (textfilecontent54_test) -- Verify the firefox preferences file starts with two forward slashes //: no extractor for field "text"
#   - textfilecontent54_object (textfilecontent54_test) -- Verify that a javascript configuration file sets general.config.obscure_value to 0: cannot derive an existence probe for this object type
#   - textfilecontent54_object (textfilecontent54_test) -- Verify that the preference name 'dom.disable_window_move_resize' is set and locked to 'true'.: no extractor for field "subexpression"

echo "MANUAL REVIEW REQUIRED -- see notes above; no part of this check could be automated"

Remediation

Ensure the preference  "dom.disable_window_move_resize"  is set and locked to the value of “true”.