CVE-2021-29946
📋 TL;DR
This vulnerability allows attackers to bypass port blocking restrictions by crafting Alt-Svc headers with integer overflow values above 65535. It affects Firefox, Firefox ESR, and Thunderbird users running vulnerable versions, potentially enabling connections to blocked ports.
💻 Affected Systems
- Firefox
- Firefox ESR
- Thunderbird
📦 What is this software?
Firefox by Mozilla
Firefox Esr by Mozilla
Thunderbird by Mozilla
⚠️ Risk & Real-World Impact
Worst Case
Attackers could bypass network security controls to establish connections to malicious servers on blocked ports, potentially leading to data exfiltration or malware delivery.
Likely Case
Bypass of port blocking policies allowing connections to unauthorized services, though exploitation requires user interaction with malicious content.
If Mitigated
Limited impact if proper network segmentation and egress filtering are in place, though browser security controls would be bypassed.
🎯 Exploit Status
Exploitation requires user to visit attacker-controlled content; no authentication needed beyond that.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Firefox 88, Firefox ESR 78.10, Thunderbird 78.10
Vendor Advisory: https://www.mozilla.org/security/advisories/mfsa2021-14/
Restart Required: Yes
Instructions:
1. Open browser settings 2. Navigate to About/Help section 3. Allow browser to check for and install updates 4. Restart browser when prompted
🔧 Temporary Workarounds
Disable Alt-Svc header processing
allPrevents browser from processing Alt-Svc headers entirely
about:config
Set network.http.altsvc.enabled to false
🧯 If You Can't Patch
- Implement network-level port blocking at firewall/IPS
- Use web proxy with strict URL filtering to block malicious sites
🔍 How to Verify
Check if Vulnerable:
Check browser version in About/Help menu and compare with affected versionsCheck Version:
Browser-specific: Firefox/Thunderbird: about: or Help → AboutVerify Fix Applied:
Verify browser version is Firefox ≥88, Firefox ESR ≥78.10, or Thunderbird ≥78.10📡 Detection & Monitoring
Log Indicators:
- Unusual outbound connections to non-standard ports from browsers
- Alt-Svc headers with port values >65535
Network Indicators:
- HTTP traffic with Alt-Svc headers containing large port numbers
- Browser connections to unexpected ports
SIEM Query:
http.headers contains "Alt-Svc" AND (http.headers contains port >65535 OR http.dest_port >1024 AND http.dest_port not in allowed_ports)🔗 References
- https://bugzilla.mozilla.org/show_bug.cgi?id=1698503
- https://www.mozilla.org/security/advisories/mfsa2021-14/
- https://www.mozilla.org/security/advisories/mfsa2021-15/
- https://www.mozilla.org/security/advisories/mfsa2021-16/
- https://bugzilla.mozilla.org/show_bug.cgi?id=1698503
- https://www.mozilla.org/security/advisories/mfsa2021-14/
- https://www.mozilla.org/security/advisories/mfsa2021-15/
- https://www.mozilla.org/security/advisories/mfsa2021-16/
