RHEL 4 / 5 : firefox

RHSA-2008:1036 is a Firefox client-side rollup for RHEL 4 and 5, not a remotely reachable daemon flaw. The advisory bundles multiple issues fixed in Firefox 3.0.5, including memory-corruption bugs that *could* lead to code execution, same-origin bypasses, XSS/session-restore issues, URL parsing quirks, and CSS parser weirdness. For Red Hat packaging, the relevant fixed builds are RHEL 4: firefox-3.0.5-1.el4, nspr-4.7.3-1.el4, nss-3.12.2.0-1.el4 and RHEL 5: firefox-3.0.5-1.el5_2, nspr-4.7.3-2.el5, nss-3.12.2.0-2.el5, xulrunner-1.9.0.5-1.el5_2.

Vendor CRITICAL is technically understandable because some bundled Mozilla advisories were rated critical and included potential arbitrary code execution during normal browsing. But in a 10,000-host enterprise patch queue, that score overstates today's operational risk: exploitation requires user interaction, an actually installed and used desktop browser on RHEL 4/5, and there is no KEV listing or current exploitation signal. This is real risk on the small number of legacy endpoints that still browse the web, but it is not the same class as an unauthenticated internet-facing RCE.

Why this verdict

• Start from vendor 10.0, then cut hard for client-side reachability: the attacker does not hit a remotely exposed daemon; they need a person to browse to hostile content.
• Cut again for implied prior stage: phishing, malvertising, or web-lure delivery is a separate initial-access step, which means this is downstream of controls like email security, proxy filtering, and browser isolation.
• Cut again for reachable population: only legacy RHEL 4/5 systems with Firefox actually installed and used interactively matter; that is a much smaller slice than the advisory product matrix suggests.
• Cut again for blast radius: successful exploitation lands in the logged-in user's context, not automatic root on a server fleet.
• Keep it at MEDIUM, not LOW: the advisory does include plausible RCE/chrome-privilege paths during normal browsing, so any legacy kiosk, admin workstation, or jump-host with active browser use is still bad debt.

Why not higher?

I am not scoring this HIGH or CRITICAL because the attack chain is stacked with real-world friction: user interaction, client-side execution, legacy platform dependency, and a likely tiny exposed population. There is also no KEV entry or modern exploitation drumbeat to justify emergency treatment across an enterprise fleet.

Why not lower?

I am not dropping this to LOW because some of the included Mozilla issues were explicitly treated as critical by Mozilla and Red Hat due to potential arbitrary code execution or privileged JavaScript during normal browsing. On any still-used legacy endpoint, compromise can still hand an attacker a real foothold.

1. Block legacy browsing paths — If these RHEL 4/5 hosts still exist, stop them from browsing arbitrary internet content by proxy policy, outbound ACLs, or browser isolation. For a MEDIUM verdict there is no mitigation SLA; use this control where patching or retirement cannot happen immediately, then complete remediation within 365 days.
2. Inventory actual browser use — Separate 'package installed' from 'browser actually used' by pulling process execution, proxy, and login telemetry. There is no mitigation SLA — go straight to the 365-day remediation window, but do the inventory now so you do not spend cycles patching dead packages on non-interactive servers.
3. Retire or isolate legacy endpoints — A host still vulnerable to a 2008 Firefox rollup is almost certainly carrying broader unsupported-software risk. Put those systems into a legacy enclave, strip outbound web access where feasible, and finish remediation or decommissioning within 365 days.
4. Hunt for browser-spawned payloads — Use EDR or shell history review to look for unusual child processes from firefox, suspicious downloads under user homes, or strange outbound sessions. There is no mitigation SLA for MEDIUM, but this is the fastest way to tell whether the residual risk is theoretical or operational.

Run this on the target RHEL host itself as root or with an account that can query the local RPM database. Save it as check_rhsa_2008_1036.sh, then run bash check_rhsa_2008_1036.sh; it checks installed RPM capabilities against the RHSA fixed versions and prints VULNERABLE, PATCHED, or UNKNOWN.

#!/bin/bash
# check_rhsa_2008_1036.sh
# Determine exposure to RHSA-2008:1036 on RHEL 4/5 using RPM package capability/version checks.
# Exit codes: 0=PATCHED/not-applicable, 1=VULNERABLE, 2=UNKNOWN

set -u

have_cmd() {
  command -v "$1" >/dev/null 2>&1
}

if ! have_cmd rpm; then
  echo "UNKNOWN rpm-not-found"
  exit 2
fi

if ! rpm -q firefox >/dev/null 2>&1; then
  echo "PATCHED firefox-not-installed"
  exit 0
fi

RHEL_MAJOR="$(rpm --eval '%{?rhel}' 2>/dev/null)"
if [[ -z "$RHEL_MAJOR" || "$RHEL_MAJOR" == "%{?rhel}" ]]; then
  if [[ -r /etc/redhat-release ]]; then
    if grep -q 'release 4' /etc/redhat-release; then
      RHEL_MAJOR=4
    elif grep -q 'release 5' /etc/redhat-release; then
      RHEL_MAJOR=5
    else
      echo "UNKNOWN unable-to-determine-rhel-major"
      exit 2
    fi
  else
    echo "UNKNOWN unable-to-determine-rhel-major"
    exit 2
  fi
fi

check_req() {
  local req="$1"
  rpm -q --whatprovides "$req" >/dev/null 2>&1
}

missing=()

case "$RHEL_MAJOR" in
  4)
    check_req 'firefox >= 3.0.5-1.el4' || missing+=("firefox>=3.0.5-1.el4")
    check_req 'nspr >= 4.7.3-1.el4' || missing+=("nspr>=4.7.3-1.el4")
    check_req 'nss >= 3.12.2.0-1.el4' || missing+=("nss>=3.12.2.0-1.el4")
    ;;
  5)
    check_req 'firefox >= 3.0.5-1.el5_2' || missing+=("firefox>=3.0.5-1.el5_2")
    check_req 'nspr >= 4.7.3-2.el5' || missing+=("nspr>=4.7.3-2.el5")
    check_req 'nss >= 3.12.2.0-2.el5' || missing+=("nss>=3.12.2.0-2.el5")
    if rpm -q xulrunner >/dev/null 2>&1; then
      check_req 'xulrunner >= 1.9.0.5-1.el5_2' || missing+=("xulrunner>=1.9.0.5-1.el5_2")
    fi
    ;;
  *)
    echo "UNKNOWN unsupported-rhel-major-$RHEL_MAJOR"
    exit 2
    ;;
esac

if [[ ${#missing[@]} -eq 0 ]]; then
  echo "PATCHED all-required-rpms-meet-rhsa-2008-1036-level"
  exit 0
fi

echo "VULNERABLE missing:${missing[*]}"
exit 1

Sources

1. Red Hat RHSA-2008:1036 advisory
2. Tenable Nessus Plugin 35191
3. Mozilla MFSA 2008-60
4. Mozilla MFSA 2008-68
5. Mozilla MFSA 2008-69
6. Mozilla MFSA 2008-66
7. NVD CVE-2008-5507
8. CISA Known Exploited Vulnerabilities Catalog