^{CVE-2021-29951:}Mozilla Maintenance Service on Windows granted excessive access permissions to users, allowing potential denial of service attacks and exposing additional attack surface.

Overview

CVE-2021-29951 is a privilege management vulnerability (CWE-269) in Mozilla's Maintenance Service on Windows systems. The service incorrectly granted SERVICE_START access permissions to the BUILTIN\Users group, which in domain network environments allows standard users to control the service. This could be exploited by attackers to prevent browser updates by continuously stopping the service or potentially to leverage the exposed attack surface for other attacks. The vulnerability only affects Windows systems older than Windows 10 build 1709, with other operating systems remaining unaffected. This security issue demonstrates the importance of proper service permission configuration, as overly permissive settings can lead to security risks even in trusted applications.

Remediation

To address this vulnerability, users should update their Mozilla applications to the following versions or newer:

• Firefox: Update to version 87 or later
• Firefox ESR: Update to version 78.10.1 or later
• Thunderbird: Update to version 78.10.1 or later

System administrators should also consider:

1. Reviewing service permissions on Windows systems, particularly in domain environments
2. Implementing least privilege principles for all services
3. Monitoring for unauthorized service control attempts
4. Ensuring automatic updates are functioning properly after applying the fix

For users unable to update immediately, limiting domain user access to affected systems can help mitigate the risk until updates can be applied.

References

1. Mozilla Foundation Security Advisory (MFSA2021-10): https://www.mozilla.org/security/advisories/mfsa2021-10/
2. Mozilla Foundation Security Advisory (MFSA2021-18): https://www.mozilla.org/security/advisories/mfsa2021-18/
3. Mozilla Foundation Security Advisory (MFSA2021-19): https://www.mozilla.org/security/advisories/mfsa2021-19/
4. Mozilla Bugzilla Issue: https://bugzilla.mozilla.org/show_bug.cgi?id=1690062
5. Common Weakness Enumeration (CWE-269): Improper Privilege Management