CVE-2021-29951

 

Published at: - 24-06-2021 04:15

Last modified: - 24-09-2022 03:03

Total changes: - 3

Description

The Mozilla Maintenance Service granted SERVICE_START access to BUILTIN|Users which, in a domain network, grants normal remote users access to start or stop the service. This could be used to prevent the browser update service from operating (if an attacker spammed the 'Stop' command); but also exposed attack surface in the maintenance service. *Note: This issue only affected Windows operating systems older than Win 10 build 1709. Other operating systems are unaffected.*. This vulnerability affects Thunderbird < 78.10.1, Firefox < 87, and Firefox ESR < 78.10.1.

Common Vulnerability Scoring System (CVSS)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

 

Verification logic

 

Reference

• https://bugzilla.mozilla.org/show_bug.cgi?id=1690062
• https://www.mozilla.org/security/advisories/mfsa2021-10/
• https://www.mozilla.org/security/advisories/mfsa2021-19/
• https://www.mozilla.org/security/advisories/mfsa2021-18/

 

Keywords

NVD

 

CVE-2021-29951

 

CVE

 

Common vulnerabilities & exposures

 

CVSS

 

Common vulnerability scoring system

 

Security

 

Vulnerabilities

 

Exposures