The researcher found that for several months Mozilla Thunderbird saved some users’ OpenPGP keys in plain text format.
For example, Thunderbird users recently realized that when they open a program, they can view emails encrypted by OpenPGP without entering their master passwords. Such messages in Thunderbird should only be viewable after authentication.
The vulnerability has been identified as CVE-2021-29956 and has a low severity level. The bug affected the mail client of all versions between 78.8.1 and 78.10.1. It allowed a local attacker to see imported OpenPGP keys stored on users’ devices without encryption. Thus, an attacker could view and copy someone else’s keys and then impersonate the sender of the protected emails.
Thunderbird maintainer Kai Engert admits that this was his personal mistake due to lack of testing. The fact is that a few months ago, the key processes were rewritten in order to improve their security.
Previously, the process for handling newly imported OpenPGP keys in Thunderbird looked like this:
- import of the secret key into a temporary memory area;
- unlocking the key using the password entered by the user;
- copying the key to permanent storage;
- protection of the key using the automatic OpenPGP password in Thunderbird;
- saving a new list of secret keys to disk.
But, according to Engert, after making changes to the code, the following happened (steps 3 and 4 were reversed):
- import of the secret key into a temporary memory area;
- unlocking the key using the password entered by the user;
- protection of the key using the automatic OpenPGP password in Thunderbird;
- copying the key to permanent storage;
- saving a new list of secret keys to disk.
In fact, when the key was copied to persistent storage, the protection was not copied along with it due to a bug in the RNP library that Thunderbird and Mozilla Firefox use to protect OpenPGP keys.
In Thunderbird version 78.10.2, the bug has been fixed, and now the mail client will check for unprotected keys in secring.gpg. If such keys are found, they will be converted to protected ones.
Let me remind you that I also wrote that Hackers used Firefox extension to hack Gmail.
