openSUSE Security Update : MozillaThunderbird (MozillaThunderbird-1303)

This script is Copyright (C) 2009-2014 Tenable Network Security, Inc.


Synopsis :

The remote openSUSE host is missing a security update.

Description :

Mozilla Thunderbird was updated to version 2.0.0.23.

The release fixes one security issue: MFSA 2009-42 / CVE-2009-2408:
IOActive security researcher Dan Kaminsky reported a mismatch in the
treatment of domain names in SSL certificates between SSL clients and
the Certificate Authorities (CA) which issue server certificates. In
particular, if a malicious person requested a certificate for a host
name with an invalid null character in it most CAs would issue the
certificate if the requester owned the domain specified after the
null, while most SSL clients (browsers) ignored that part of the name
and used the unvalidated part in front of the null. This made it
possible for attackers to obtain certificates that would function for
any site they wished to target. These certificates could be used to
intercept and potentially alter encrypted communication between the
client and a server such as sensitive bank account transactions. This
vulnerability was independently reported to us by researcher Moxie
Marlinspike who also noted that since Firefox relies on SSL to protect
the integrity of security updates this attack could be used to serve
malicious updates.

See also :

https://bugzilla.novell.com/show_bug.cgi?id=534782

Solution :

Update the affected MozillaThunderbird packages.

Risk factor :

Medium / CVSS Base Score : 6.8
(CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P)

Family: SuSE Local Security Checks

Nessus Plugin ID: 41011 ()

Bugtraq ID:

CVE ID: CVE-2009-2408

Ready to Amp Up Your Nessus Experience?

Get Nessus Professional to scan unlimited IPs, run compliance checks & more

Buy Nessus Professional Now