Ubuntu 6.06 LTS / 7.04 / 7.10 / 8.04 LTS : mozilla-thunderbird, thunderbird vulnerabilities (USN-629-1)

Ubuntu Security Notice (C) 2008-2014 Canonical, Inc. / NASL script (C) 2008-2014 Tenable Network Security, Inc.


Synopsis :

The remote Ubuntu host is missing one or more security-related patches.

Description :

Various flaws were discovered in the browser engine. If a user had
JavaScript enabled and were tricked into opening a malicious web page,
an attacker could cause a denial of service via application crash, or
possibly execute arbitrary code with the privileges of the user
invoking the program. (CVE-2008-2798, CVE-2008-2799)

It was discovered that Thunderbird would allow non-privileged XUL
documents to load chrome scripts from the fastload file if JavaScript
was enabled. This could allow an attacker to execute arbitrary
JavaScript code with chrome privileges. (CVE-2008-2802)

A flaw was discovered in Thunderbird that allowed overwriting trusted
objects via mozIJSSubScriptLoader.loadSubScript(). If a user had
JavaScript enabled and was tricked into opening a malicious web page,
an attacker could execute arbitrary code with the privileges of the
user invoking the program. (CVE-2008-2803)

Daniel Glazman found that an improperly encoded .properties file in an
add-on can result in uninitialized memory being used. If a user were
tricked into installing a malicious add-on, Thunderbird may be able to
see data from other programs. (CVE-2008-2807)

John G. Myers discovered a weakness in the trust model used by
Thunderbird regarding alternate names on self-signed certificates. If
a user were tricked into accepting a certificate containing alternate
name entries, an attacker could impersonate another server.
(CVE-2008-2809)

A vulnerability was discovered in the block reflow code of
Thunderbird. If a user enabled JavaScript, this vulnerability could be
used by an attacker to cause a denial of service via application
crash, or execute arbitrary code with the privileges of the user
invoking the program. (CVE-2008-2811)

A flaw was discovered in the browser engine. A variable could be made
to overflow causing Thunderbird to crash. If a user enable JavaScript
and was tricked into opening a malicious web page, an attacker could
cause a denial of service or possibly execute arbitrary code with the
privileges of the user invoking the program. (CVE-2008-2785)

Mozilla developers audited the MIME handling code looking for similar
vulnerabilities to the previously fixed CVE-2008-0304, and changed
several function calls to use safer versions of string routines.

Solution :

Update the affected packages.

Risk factor :

Critical / CVSS Base Score : 10.0
(CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C)
Public Exploit Available : true

Family: Ubuntu Local Security Checks

Nessus Plugin ID: 33587 ()

Bugtraq ID:

CVE ID: CVE-2008-0304
CVE-2008-2785
CVE-2008-2798
CVE-2008-2799
CVE-2008-2802
CVE-2008-2803
CVE-2008-2807
CVE-2008-2809
CVE-2008-2811