Versions of Mozilla Thunderbird prior to 2.0.0.22 are affected by the following security issues :

 - Multiple remote memory corruption vulnerabilities exist which can be exploited to execute arbitrary code in the context of the user running the affected application. (MFSA 2009-14)
 - A flaw may exist where Unicode box drawing characters are allowed in Internationalized Domain Names where they could be visually confused with punctuation used in valid web addresses. An attacker can leverage this to launch a phishing-type scam against a victim. (MFSA 2009-15)
 - A vulnerability exists when the 'jar:' scheme is used to wrap a URI which serves the content with 'Content-Disposition: attachment'. An attacker can leverage this to subvert sites which use this mechanism to mitigate content injection attacks. (MFSA 2009-16)
 - When an Adobe Flash file is loaded via the 'view-source:' scheme, the Flash plugin misinterprets the origin of the content as localhost. An attacker can leverage this to launch cross-site request forger attacks. It is also possible to exploit this to place cookie-like objects on victim's computers. (MFSA 2009-17)
 - A vulnerability exists which allows attackers to inject arbitrary scripts into sites via XBL bindings. This vulnerability requires the attacker to have the ability to embed third-party stylesheets into the site. (MFSA 2009-18)
 - Multiple remote code execution vulnerabilities exist caused by the creation of documents whose URI does not match the document's principle using XMLHttpRequest, as well as a flaw in the 'XPCNativeWrapper.ToString' '__proto__' coming from the wrong scope. (MFSA 2009-19)
 - A malicious MozSearch plugin could be created using a javascript: URI in the SearchForm value. An attacker can leverage this in order to inject code into arbitrary sites. (MFSA 2009-20)
 - An information disclosure vulnerability exists when saving the inner frame of a web page as a file when the outer page has POST data associated with it. (MFSA 2009-21)
 - A cross site scripting vulnerability exists when handling a Refresh header containing a javascript: URI. (MFSA 2009-22)" ); 

The mail client was identified via browser-like web traffic.

The remote host is running a vulnerable version of Mozilla Thunderbird mail client. This version of Thunderbird is vulnerable to multiple denial of service attacks, overflows, information disclosure, privilege escalation, and other issues.  An attacker exploiting these flaws would need to be able to convince a user to open or read a malicious email.  Successful exploitation would give the attacker the ability to execute arbitrary code with the permissions of the user running Thunderbird. 

The remote client is running Microsoft Outlook Express.  The noted version of Outlook Express is vulnerable to a buffer overflow in the way that it handles the parsing of .wab files.  An attacker exploiting this flaw would need to be able to entice the user into opening the attachment.  Successful exploitation would result in code being executed with the rights of the compromised user. 

The remote host is using Outlook Express version 6.00 or 6.00 SP1. It is reported that the effectiveness of the BCC: field in these versions cannot be trusted. People receiving the mail through the To: and CC: fields can find the invisible receipients by opening the mail in a text editor. 

The remote host is using DtMail, a mail user agent included in CDE, the default desktop environment for Sun Solaris. It is reported that versions of DtMail shipped with Solaris 8 and 9 are prone to a local format string issue. An local attacker may exploit this vulnerability to execute malicious code with mail group privileges.

ID	Name	Severity
5001	Mozilla Thunderbird < 2.0.0.22 Multiple Vulnerabilities	medium
3537	Mozilla Thunderbird Version Detection (Web Traffic)	info
3513	Mozilla Thunderbird < 1.5.0.2 or 1.0.8 Multiple Vulnerabilities (deprecated)	medium
3510	Outlook Express .wab File Processing Overflow	medium
2150	Outlook Express BCC: Recipient Disclosure	medium
2145	DtMail Local Format String Privilege Escalation	medium

Detections

Analytics

SMTP Clients Family for Nessus Network Monitor

medium

info

medium

medium

medium

medium