Tech News

Mozilla Thunderbird email client stored OpenPGP keys in clear text

The researcher found that for several months Mozilla Thunderbird saved some users’ OpenPGP keys in plain text format.

For example, Thunderbird users recently realized that when they open a program, they can view emails encrypted by OpenPGP without entering their master passwords. Such messages in Thunderbird should only be viewable after authentication.

The vulnerability has been identified as CVE-2021-29956 and has a low severity level. The bug affected the mail client of all versions between 78.8.1 and 78.10.1. It allowed a local attacker to see imported OpenPGP keys stored on users’ devices without encryption. Thus, an attacker could view and copy someone else’s keys and then impersonate the sender of the protected emails.

Thunderbird maintainer Kai Engert admits that this was his personal mistake due to lack of testing. The fact is that a few months ago, the key processes were rewritten in order to improve their security.

Previously, the process for handling newly imported OpenPGP keys in Thunderbird looked like this:

  • import of the secret key into a temporary memory area;
  • unlocking the key using the password entered by the user;
  • copying the key to permanent storage;
  • protection of the key using the automatic OpenPGP password in Thunderbird;
  • saving a new list of secret keys to disk.

But, according to Engert, after making changes to the code, the following happened (steps 3 and 4 were reversed):

  • import of the secret key into a temporary memory area;
  • unlocking the key using the password entered by the user;
  • protection of the key using the automatic OpenPGP password in Thunderbird;
  • copying the key to permanent storage;
  • saving a new list of secret keys to disk.
The author of the code (that is, me) and the reviewer suggested that this would be equivalent to [the previous version]. But our assumption that the protection of the private key in step 3 will be preserved when copied to another area … turned out to be false.says Engert.

In fact, when the key was copied to persistent storage, the protection was not copied along with it due to a bug in the RNP library that Thunderbird and Mozilla Firefox use to protect OpenPGP keys.

In Thunderbird version 78.10.2, the bug has been fixed, and now the mail client will check for unprotected keys in secring.gpg. If such keys are found, they will be converted to protected ones.

Let me remind you that I also wrote that Hackers used Firefox extension to hack Gmail.

Vladimir Krasnogolovy

Vladimir is a technical specialist who loves giving qualified advices and tips on GridinSoft's products. He's available 24/7 to assist you in any question regarding internet security.

Related Articles

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.

Back to top button