Several remote vulnerabilities have been discovered in the Icedove mail client, an unbranded version of the Thunderbird mail client. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2009-2408     Dan Kaminsky and Moxie Marlinspike discovered that     icedove does not properly handle a '\0' character in a     domain name in the subject's Common Name (CN) field of     an X.509 certificate (MFSA 2009-42).

  - CVE-2009-2404     Moxie Marlinspike reported a heap overflow vulnerability     in the code that handles regular expressions in     certificate names (MFSA 2009-43).

  - CVE-2009-2463     monarch2020 discovered an integer overflow in a base64     decoding function (MFSA 2010-07).

  - CVE-2009-3072     Josh Soref discovered a crash in the BinHex decoder     (MFSA 2010-07).

  - CVE-2009-3075     Carsten Book reported a crash in the JavaScript engine     (MFSA 2010-07).

  - CVE-2010-0163     Ludovic Hirlimann reported a crash indexing some     messages with attachments, which could lead to the     execution of arbitrary code (MFSA 2010-07).

The remote Redhat Enterprise Linux 4 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2010:0154 advisory.

    Mozilla Thunderbird is a standalone mail and newsgroup client.

    Several flaws were found in the processing of malformed HTML mail content.
    An HTML mail message containing malicious content could cause Thunderbird     to crash or, potentially, execute arbitrary code with the privileges of the     user running Thunderbird. (CVE-2009-2462, CVE-2009-2463, CVE-2009-2466,     CVE-2009-3072, CVE-2009-3075, CVE-2009-3380, CVE-2009-3979, CVE-2010-0159)

    A use-after-free flaw was found in Thunderbird. An attacker could use this     flaw to crash Thunderbird or, potentially, execute arbitrary code with the     privileges of the user running Thunderbird. (CVE-2009-3077)

    A heap-based buffer overflow flaw was found in the Thunderbird string to     floating point conversion routines. An HTML mail message containing     malicious JavaScript could crash Thunderbird or, potentially, execute     arbitrary code with the privileges of the user running Thunderbird.
    (CVE-2009-0689)

    A use-after-free flaw was found in Thunderbird. Under low memory     conditions, viewing an HTML mail message containing malicious content could     result in Thunderbird executing arbitrary code with the privileges of the     user running Thunderbird. (CVE-2009-1571)

    A flaw was found in the way Thunderbird created temporary file names for     downloaded files. If a local attacker knows the name of a file Thunderbird     is going to download, they can replace the contents of that file with     arbitrary contents. (CVE-2009-3274)

    A flaw was found in the way Thunderbird displayed a right-to-left override     character when downloading a file. In these cases, the name displayed in     the title bar differed from the name displayed in the dialog body. An     attacker could use this flaw to trick a user into downloading a file that     has a file name or extension that is different from what the user expected.
    (CVE-2009-3376)

    A flaw was found in the way Thunderbird processed SOCKS5 proxy replies. A     malicious SOCKS5 server could send a specially-crafted reply that would     cause Thunderbird to crash. (CVE-2009-2470)

    Descriptions in the dialogs when adding and removing PKCS #11 modules were     not informative. An attacker able to trick a user into installing a     malicious PKCS #11 module could use this flaw to install their own     Certificate Authority certificates on a user's machine, making it possible     to trick the user into believing they are viewing trusted content or,     potentially, execute arbitrary code with the privileges of the user running     Thunderbird. (CVE-2009-3076)

    All Thunderbird users should upgrade to this updated package, which     resolves these issues. All running instances of Thunderbird must be     restarted for the update to take effect.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Several flaws were discovered in the JavaScript engine of Thunderbird.
If a user had JavaScript enabled and were tricked into viewing malicious web content, a remote attacker could cause a denial of service or possibly execute arbitrary code with the privileges of the user invoking the program. (CVE-2009-0689, CVE-2009-2463, CVE-2009-3075)

Josh Soref discovered that the BinHex decoder used in Thunderbird contained a flaw. If a user were tricked into viewing malicious content, a remote attacker could cause a denial of service or possibly execute arbitrary code with the privileges of the user invoking the program. (CVE-2009-3072)

It was discovered that Thunderbird did not properly manage memory when using XUL tree elements. If a user were tricked into viewing malicious content, a remote attacker could cause a denial of service or possibly execute arbitrary code with the privileges of the user invoking the program. (CVE-2009-3077)

Jesse Ruderman and Sid Stamm discovered that Thunderbird did not properly display filenames containing right-to-left (RTL) override characters. If a user were tricked into opening a malicious file with a crafted filename, an attacker could exploit this to trick the user into opening a different file than the user expected. (CVE-2009-3376)

Takehiro Takahashi discovered flaws in the NTLM implementation in Thunderbird. If an NTLM authenticated user opened content containing links to a malicious website, a remote attacker could send requests to other applications, authenticated as the user. (CVE-2009-3983)

Ludovic Hirlimann discovered a flaw in the way Thunderbird indexed certain messages with attachments. A remote attacker could send specially crafted content and cause a denial of service or possibly execute arbitrary code with the privileges of the user invoking the program. (CVE-2010-0163).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Mozilla Project reports :

MFSA 2010-07 Fixes for potentially exploitable crashes ported to the legacy branch

MFSA 2010-06 Scriptable plugin execution in SeaMonkey mail

MFSA 2009-68 NTLM reflection vulnerability

MFSA 2009-62 Download filename spoofing with RTL override

MFSA 2009-59 Heap buffer overflow in string to number conversion

MFSA 2009-49 TreeColumns dangling pointer vulnerability

ID	Name	Product	Family	Published	Updated	Severity
45397	Debian DSA-2025-1 : icedove - several vulnerabilities	Nessus	Debian Local Security Checks	4/1/2010	1/4/2021	critical
46271	RHEL 4 : thunderbird (RHSA-2010:0154)	Nessus	Red Hat Local Security Checks	5/11/2010	11/4/2024	medium
45108	Ubuntu 8.04 LTS / 8.10 / 9.04 / 9.10 : thunderbird vulnerabilities (USN-915-1)	Nessus	Ubuntu Local Security Checks	3/19/2010	9/19/2019	critical
45114	FreeBSD : mozilla -- multiple vulnerabilities (56cfe192-329f-11df-abb2-000f20797ede)	Nessus	FreeBSD Local Security Checks	3/22/2010	1/6/2021	critical

Detections

Analytics

Plugins Search

critical

medium

critical

critical