CVE-2021-29949
📋 TL;DR
This vulnerability allows Thunderbird to load a malicious shared library instead of the legitimate OTR protocol library due to an incorrect filename search order. Attackers who can place a malicious library in a directory within Thunderbird's search path can execute arbitrary code. This affects Thunderbird users with versions below 78.9.1.
💻 Affected Systems
- Mozilla Thunderbird
📦 What is this software?
Thunderbird by Mozilla
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise via arbitrary code execution with the privileges of the Thunderbird process, potentially leading to data theft, malware installation, or lateral movement.
Likely Case
Local privilege escalation or persistence mechanism for attackers who already have some access to the system, allowing them to maintain control or escalate privileges.
If Mitigated
No impact if Thunderbird is updated to patched version or if proper file system permissions prevent unauthorized library placement.
🎯 Exploit Status
Requires local file system access to plant malicious library. No public exploit code available as of knowledge cutoff.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 78.9.1
Vendor Advisory: https://www.mozilla.org/security/advisories/mfsa2021-13/
Restart Required: Yes
Instructions:
1. Open Thunderbird. 2. Go to Help > About Thunderbird. 3. Allow automatic update check and installation. 4. Restart Thunderbird when prompted. 5. Verify version is 78.9.1 or higher.
🔧 Temporary Workarounds
Restrict library search paths
allModify environment variables to limit directories Thunderbird searches for libraries
export LD_LIBRARY_PATH=/usr/lib:/usr/local/lib (Linux)
set PATH=C:\Program Files\Mozilla Thunderbird (Windows)
File system permissions
allSet restrictive permissions on directories in Thunderbird's library search path
chmod 755 /usr/local/lib && chown root:root /usr/local/lib (Linux)
icacls "C:\Program Files\Mozilla Thunderbird" /deny Everyone:(OI)(CI)(W) (Windows)
🧯 If You Can't Patch
- Restrict file system permissions to prevent unauthorized users from writing to Thunderbird library directories
- Monitor for suspicious library files in Thunderbird search paths using file integrity monitoring
🔍 How to Verify
Check if Vulnerable:
Check Thunderbird version in Help > About Thunderbird. If version is below 78.9.1, system is vulnerable.Check Version:
thunderbird --version (Linux/macOS) or check Help > About in GUI (all platforms)Verify Fix Applied:
Verify Thunderbird version is 78.9.1 or higher in Help > About Thunderbird.📡 Detection & Monitoring
Log Indicators:
- Failed library loading attempts in Thunderbird logs
- Unexpected library files in Thunderbird directories
Network Indicators:
- None - this is a local file system vulnerability
SIEM Query:
Process creation where parent process is thunderbird.exe and command line includes suspicious library loading