Mozilla Thunderbird < 2.0.0.19 Multiple Vulnerabilities

high Nessus Plugin ID 35287

Synopsis

The remote Windows host contains a mail client that is affected by multiple vulnerabilities.

Description

The installed version of Thunderbird is earlier than 2.0.0.19. Such versions are potentially affected by the following security issues :

- There are several stability bugs in the browser engine that could lead to crashes with evidence of memory corruption. (MFSA 2008-60)

- XBL bindings can be used to read data from other domains. (MFSA 2008-61)

- Sensitive data could be disclosed in an XHR response when an XMLHttpRequest is made to a same-origin resource, which 302 redirects to a resource in a different domain. (MFSA 2008-64)

- A website may be able to access a limited amount of data from a different domain by loading a same-domain JavaScript URL, which redirects to an off-domain target resource containing data that is not parsable as JavaScript. (MFSA 2008-65)

- Errors arise when parsing URLs with leading whitespace and control characters. (MFSA 2008-66)

- An escaped null byte is ignored by the CSS parser and treated as if it was not present in the CSS input string. (MFSA 2008-67)

- XSS and JavaScript privilege escalation are possible.
(MFSA 2008-68)

Solution

Upgrade to Mozilla Thunderbird 2.0.0.19 or later.

See Also

https://www.mozilla.org/en-US/security/advisories/mfsa2008-60/

https://www.mozilla.org/en-US/security/advisories/mfsa2008-61/

https://www.mozilla.org/en-US/security/advisories/mfsa2008-64/

https://www.mozilla.org/en-US/security/advisories/mfsa2008-65/

https://www.mozilla.org/en-US/security/advisories/mfsa2008-66/

https://www.mozilla.org/en-US/security/advisories/mfsa2008-67/

https://www.mozilla.org/en-US/security/advisories/mfsa2008-68/

http://www.nessus.org/u?35fe47a6

Plugin Details

Severity: High

ID: 35287

File Name: mozilla_thunderbird_20019.nasl

Version: 1.16

Type: local

Agent: windows

Family: Windows

Published: 1/2/2009

Updated: 11/15/2018

Supported Sensors: Frictionless Assessment Agent, Frictionless Assessment AWS, Frictionless Assessment Azure, Nessus Agent

Risk Information

VPR

Risk Factor: Medium

Score: 5.9

CVSS v2

Risk Factor: High

Base Score: 9.3

Temporal Score: 6.9

Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C

Temporal Vector: E:U/RL:OF/RC:C

Vulnerability Information

CPE: cpe:/a:mozilla:thunderbird

Required KB Items: Mozilla/Thunderbird/Version

Exploit Ease: No known exploits are available

Patch Publication Date: 12/16/2008

Reference Information

CVE: CVE-2008-5500, CVE-2008-5503, CVE-2008-5506, CVE-2008-5507, CVE-2008-5508, CVE-2008-5510, CVE-2008-5511, CVE-2008-5512

BID: 32882

CWE: 20, 79, 200, 264, 399