The SMTP client in Mozilla Thunderbird 1.0.5 BETA, 1.0.7, and possibly other versions, does not notify users when it cannot establish a secure channel with the server, which allows remote attackers to obtain authentication information without detection via a man-in-the-middle (MITM) attack that bypasses TLS authentication or downgrades CRAM-MD5 authentication to plain authentication.
http://marc.info/?l=bugtraq&m=113028017608146&w=2
http://marc.info/?l=bugtraq&m=113034421329653&w=2
Source: MITRE
Published: 2005-11-01
Updated: 2016-10-18
Type: NVD-CWE-Other
Base Score: 2.6
Vector: AV:N/AC:H/Au:N/C:P/I:N/A:N
Impact Score: 2.9
Exploitability Score: 4.9
Severity: LOW
OR
ID | Name | Product | Family | Severity |
---|---|---|---|---|
3258 | Mozilla Thunderbird < 1.5 Multiple Vulnerabilities (deprecated) | Nessus Network Monitor | SMTP Clients | medium |