CVE-2021-29964
📋 TL;DR
This vulnerability allows a malicious program already running on a Windows system to send specially crafted WM_COPYDATA messages to Firefox, causing an out-of-bounds memory read. This could potentially leak sensitive information from Firefox's memory. Only affects Firefox, Thunderbird, and Firefox ESR on Windows operating systems.
💻 Affected Systems
- Firefox
- Thunderbird
- Firefox ESR
📦 What is this software?
Firefox by Mozilla
Firefox Esr by Mozilla
Thunderbird by Mozilla
⚠️ Risk & Real-World Impact
Worst Case
Information disclosure of sensitive data from Firefox's memory space, potentially including session cookies, passwords, or other private user data.
Likely Case
Limited information disclosure of non-sensitive memory contents due to the constrained nature of out-of-bounds reads.
If Mitigated
No impact if systems are patched or if proper endpoint security prevents malicious local programs from executing.
🎯 Exploit Status
Requires local program execution on target Windows system. Exploit would need to bypass standard Windows security controls to run malicious code locally.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Thunderbird 78.11+, Firefox 89+, Firefox ESR 78.11+
Vendor Advisory: https://www.mozilla.org/security/advisories/mfsa2021-23/
Restart Required: Yes
Instructions:
1. Open Firefox/Thunderbird. 2. Click menu → Help → About Firefox/Thunderbird. 3. Allow automatic update to complete. 4. Restart browser when prompted.
🔧 Temporary Workarounds
Disable automatic updates check
windowsTemporarily disable automatic updates to prevent potential exploitation during update process
Not applicable - configure via browser settings
🧯 If You Can't Patch
- Restrict local program execution through application whitelisting or endpoint security
- Use alternative browsers on Windows systems until patches can be applied
🔍 How to Verify
Check if Vulnerable:
Check browser version: Firefox/Thunderbird → Help → About. If version is below patched versions, system is vulnerable.Check Version:
Not applicable - check via browser GUI or registry: HKEY_CURRENT_USER\Software\Mozilla\Firefox for version infoVerify Fix Applied:
Confirm browser version is Thunderbird ≥78.11, Firefox ≥89, or Firefox ESR ≥78.11 after update.📡 Detection & Monitoring
Log Indicators:
- Unusual WM_COPYDATA message processing in Windows event logs
- Browser crash reports related to memory access violations
Network Indicators:
- None - this is a local exploitation vulnerability
SIEM Query:
Windows Event ID 1000 (Application Error) with Firefox/Thunderbird process names and exception code 0xC0000005 (ACCESS_VIOLATION)🔗 References
- https://bugzilla.mozilla.org/show_bug.cgi?id=1706501
- https://www.mozilla.org/security/advisories/mfsa2021-23/
- https://www.mozilla.org/security/advisories/mfsa2021-24/
- https://www.mozilla.org/security/advisories/mfsa2021-26/
- https://bugzilla.mozilla.org/show_bug.cgi?id=1706501
- https://www.mozilla.org/security/advisories/mfsa2021-23/
- https://www.mozilla.org/security/advisories/mfsa2021-24/
- https://www.mozilla.org/security/advisories/mfsa2021-26/
