CVE-2023-29532

What it actually does

Race condition in the Mozilla Maintenance Service on Windows allows a local attacker to replace a signed update file with an unsigned one after signature verification but before application, because file write-locks do not function correctly against SMB shares.

Why it matters to the business

Attackers with local access on Windows systems can force installation of arbitrary code through the update mechanism, potentially leading to persistent unauthorized control of affected Mozilla applications and the underlying host.

How an attack unfolds

An attacker with local system access configures the Maintenance Service to fetch an update from a malicious SMB server. After the service verifies the signature on the initial file, the attacker replaces the file on the share before the service applies it, bypassing signature enforcement due to the ineffective write-lock.

How to fix it

Upgrade Firefox to version 112 or later, Firefox ESR to 102.10 or later, and Thunderbird to 102.10 or later. Ensure the Mozilla Maintenance Service is running the patched version on all Windows endpoints.

How to confirm the fix worked

Confirm installed versions meet or exceed the fixed releases listed above and verify that update operations no longer accept files from untrusted SMB locations without proper locking.

Typical attack path

1. Obtain local system access on a Windows host running an affected Mozilla product
2. Place a legitimately signed update file on a controlled SMB share
3. Point the Mozilla Maintenance Service at the malicious SMB path
4. Replace the file with unsigned malicious content after signature check completes
5. Allow the service to apply the tampered update and execute attacker code

How to detect it

Review Windows event logs and Mozilla Maintenance Service logs for update operations sourcing from SMB paths or unexpected file modifications between signature verification and application; look for process anomalies during update execution.

What your security team should do

• Prioritize patching all Windows installations of Firefox, Firefox ESR, and Thunderbird to the fixed versions
• Restrict local user ability to modify Maintenance Service configuration or point it at untrusted network paths
• Monitor for unusual update activity originating from SMB shares in endpoint logs