CVE-2021-29951 Privilege escalation in Firefox
Normal users can start or stop the Mozilla Maintenance Service, potentially causing denial of service or exposing attack surface for privilege escalation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-29951?
CVE-2021-29951 is a medium-severity vulnerability in Mozilla Firefox, published on 24 Jun 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Mozilla Maintenance Service granted SERVICE_START access to BUILTIN|Users which, in a domain network, grants normal remote users access to start or stop the service. This could be used to prevent the browser update service from operating (if an attacker spammed the 'Stop' command); but also exposed attack surface in the maintenance service. *Note: This issue only affected Windows operating systems older than Win 10 build 1709. Other operating systems are unaffected.*. This vulnerability affects Thunderbird < 78.10.1, Firefox < 87, and Firefox ESR < 78.10.1.
Weakness: CWE-269
Which versions are affected by CVE-2021-29951?
It affects 3 products.
Products include Mozilla Firefox, Mozilla Firefox Esr, Mozilla Thunderbird.
How do I fix CVE-2021-29951?
Upgrade to a fixed version.
Is CVE-2021-29951 being exploited?
There is no known exploitation of CVE-2021-29951 in the wild and no public exploit code.
Other vulnerabilities in Mozilla Firefox
Sources
Also known as GHSA-rc27-w7x3-jmp4.