|
Mozilla Thunderbird Multiple Vulnerabilities
|
|
Secunia Advisory:
|
SA15907
|
|
|
Release Date:
|
2006-01-17
|
|
Last Update:
|
2006-05-04
|
|
Popularity:
|
13,758 views
|
|
|
Critical:
|
Moderately critical
|
|
Impact:
|
Security Bypass
Cross Site Scripting
Spoofing
DoS
System access
|
|
Where:
|
From remote
|
|
Solution Status:
|
Vendor Patch
|
|
| Software: | Mozilla Thunderbird 1.0.x
|
|
|
Subscribe:
|
Instant alerts on relevant vulnerabilities 
|
| | CVE reference: | CVE-2006-0236
CVE-2006-0884
CVE-2006-1731
CVE-2006-1732
CVE-2006-1733
CVE-2006-1734
CVE-2006-1735
CVE-2006-1737
CVE-2006-1738
CVE-2006-1739
CVE-2006-1741
CVE-2006-1742
CVE-2006-0749
|
|
Description:
Some vulnerabilities have been reported in Thunderbird, which can be exploited by malicious people to conduct cross-site scripting attacks, bypass certain security restrictions, trick users into executing arbitrary programs, and potentially compromise a user's system.
1) An error caused due to attachments not being displayed correctly in mails can be exploited to spoof the file extension and the associated file type icon via a combination of overly long filenames containing whitespaces and "Content-Type" headers not matching the file extension.
Successful exploitation may lead to malware being saved to e.g. the desktop.
NOTE: Attachments can be saved by dragging the attachment, or using the "Save As..." or "Save All..." functionality. For files on the desktop, the icon can be spoofed if it e.g. is a ".exe" or ".lnk" file.
The vulnerability has been confirmed in versions 1.0.2, 1.0.6, and 1.0.7. Other versions may also be affected. Only the Microsoft Windows platform is affected.
2) Scripts in e-mails can be executed even when JavaScript has been disabled (JavaScript is disabled by default). This can be exploited when a user edits a HTML mail message (e.g. when replying) with a JavaScript URI handler in the "src" attribute of an "iframe" tag. This does not pose any direct security risks by itself, but may enable exploitation of vulnerabilities requiring JavaScript.
The vulnerability has been confirmed in version 1.0.7 and has also been reported in prior versions.
3) An error in the garbage collection in the JavaScript engine can be exploited to cause a memory corruption.
Successful exploitation may allow execution of arbitrary code, but requires that JavaScript is enabled (not default setting).
4) A boundary error in the CSS border rendering implementation may be exploited to write past the end of an array.
Successful exploitation requires that JavaScript is enabled (not default setting).
5) An integer overflow in the handling of overly long regular expressions in JavaScript may be exploited to execute arbitrary JavaScript bytecode.
Successful exploitation requires that JavaScript is enabled (not default setting).
6) Two errors in the handling of "-moz-grid" and "-moz-grid-group" display styles may be exploited to execute arbitrary code.
Successful exploitation requires that JavaScript is enabled (not default setting).
7) An error in the "InstallTrigger.install()" method can be exploited to cause a memory corruption.
Successful exploitation requires that JavaScript is enabled (not default setting).
8) A JavaScript function created via an "eval()" call associated with a method of an XBL binding may be compiled with incorrect privileges. This can be exploited to execute arbitrary code.
Successful exploitation requires that JavaScript is enabled (not default setting).
9) An error where the "Object.watch()" method exposes the internal "clone parent" function object can be exploited to execute arbitrary JavaScript code with escalated privileges.
Successful exploitation allows execution of arbitrary code, but requires that JavaScript is enabled (not default setting).
10) An error in the protection of the compilation scope of built-in privileged XBL bindings can be exploited to execute arbitrary JavaScript code with escalated privileges.
Successful exploitation allows execution of arbitrary code, but requires that JavaScript is enabled (not default setting).
11) An unspecified error can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an arbitrary site via the window.controllers array.
Successful exploitation requires that JavaScript is enabled (not default setting).
12) An error in the processing of a certain sequence of HTML tags can be exploited to cause a memory corruption.
Successful exploitation allows execution of arbitrary code, but requires that JavaScript is enabled (not default setting).
13) An error in the "valueOf.call()" and "valueOf.apply()" methods can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an arbitrary site.
Successful exploitation requires that JavaScript is enabled (not default setting).
Solution:
Update to version 1.5.
http://www.mozilla.com/thunderbird/
Provided and/or discovered by:
1) Andreas Sandblad, Secunia Research
2) nono2357, sysdream
3) Igor Bukanov
4) Bernd Mielke
5) Alden D'Souza
6) Martijn Wargers
7) Bob Clary
8, 9, 11) shutdown
10, 13) moz_bug_r_a4
12) TippingPoint and the Zero Day Initiative
Changelog:
2006-01-25: Added CVE reference.
2006-02-23: Added additional vulnerability provided by nono2357.
2006-03-02: Added CVE reference.
2006-04-14: Vendor discloses details about additional vulnerabilities. Updated advisory.
2006-05-04: Updated affected software.
Original Advisory:
Secunia Research:
http://secunia.com/secunia_research/2005-22/advisory/
Mozilla:
http://www.mozilla.org/security/announce/2006/mfsa2006-10.html
http://www.mozilla.org/security/announce/2006/mfsa2006-11.html
http://www.mozilla.org/security/announce/2006/mfsa2006-14.html
http://www.mozilla.org/security/announce/2006/mfsa2006-15.html
http://www.mozilla.org/security/announce/2006/mfsa2006-16.html
http://www.mozilla.org/security/announce/2006/mfsa2006-17.html
http://www.mozilla.org/security/announce/2006/mfsa2006-18.html
http://www.mozilla.org/security/announce/2006/mfsa2006-19.html
Other References:
https://bugzilla.mozilla.org/show_bug.cgi?id=300246
|
|
|
Track this Secunia Advisory
|
Customers of the Secunia Vulnerability Intelligence solutions will automatically receive updates when new information regarding this advisory is released.
Read more about our Vulnerability Intelligence solutions and what they can do for you and your company.
|
|
|
About this Secunia Advisory
|
Please note: The information that this Secunia Advisory is based on comes from a third party unless stated otherwise.
Secunia collects, validates, and verifies all vulnerability reports issued by security research groups, vendors, and others.
|
|
|
13th Oct, 2008
|
New advisories:
|
19 |
|
New vulnerabilities:
|
31 |
|
Updated advisories:
|
28 |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
 Solutions | More...
|
|
