documentation_complete: true

title: 'Disable Addons Plugin Updates'

description: "Firefox automatically updates installed add-ons and plugins which \ncan be disabled by setting <tt>extensions.update.enabled</tt> to\n<tt>false</tt>."

rationale: |-
    Automatic updates from untrusted sites puts the enclave at
    risk of attack and may override security settings.

severity: medium

identifiers:
    cce: ""

references:
    disa: ""
    nist: ECSC-1
    stigid: DTBF090

ocil_clause: 'it is not disabled'

ocil: |-
    To verify that add-ons and plugins cannot automatically update,
    run the following command:
    <pre>$ grep 'extensions.update.enabled' <i>FIREFOX_INSTALL_DIR</i>/*.cfg</pre>
    The output should return:
    <pre>lockPref("extensions.update.enabled", false);</pre>
