Technical Description

Multiple vulnerabilities have been identified in Mozilla Thunderbird, which could be exploited by attackers to bypass security restrictions, disclose sensitive information, cause a denial of service or take complete control of an affected system.

The first issue is caused by memory corruption errors in the browser and JavaScript engines when parsing malformed data, which could be exploited by attackers to crash a vulnerable application or execute arbitrary code.

The second vulnerability is caused by errors when processing JavaScript, which could be exploited by malicious web sites to execute arbitrary code or gain knowledge of sensitive information.

The third issue is caused by an input validation error when handling "chrome:" URIs, which could be exploited by attackers to load JavaScript, images, and stylesheets from local files in known locations. For additional information, see : VUPEN/ADV-2008-0263

The fourth weakness is caused by an error when displaying timer-enabled security dialogs, which could be exploited by attackers to trick a user into confirming a security dialog by bringing the dialog back into focus right before a user clicked in a predictable time and place.

The fifth vulnerbility is caused by an error in the BMP decoder when handling methods associated with the "canvas" feature, which could be exploited by attackers to reveal small chunks of uninitialized memory that might contain sensitive data from other pages or other programs.

The sixth issue is caused by a buffer overflow error when handling email messages with an external MIME body, which could be exploited to crash an affected application or execute arbitrary code.

Affected Products

Mozilla Thunderbird versions prior to 2.0.0.12

Solution

Upgrade to Mozilla Thunderbird version 2.0.0.12 :
http://www.mozilla.com/thunderbird/

References

http://www.vupen.com/english/advisories/2008/0454
http://www.mozilla.org/security/announce/2008/mfsa2008-01.html
http://www.mozilla.org/security/announce/2008/mfsa2008-03.html
http://www.mozilla.org/security/announce/2008/mfsa2008-05.html
http://www.mozilla.org/security/announce/2008/mfsa2008-07.html
http://www.mozilla.org/security/announce/2008/mfsa2008-08.html
http://www.mozilla.org/security/announce/2008/mfsa2008-12.html
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=668

Credits

Vulnerabilities reported by Jesse Ruderman, Kai Engert, Martijn Wargers, Mats Palmgren, Paul Nickerson, Justin Dolske, Gerry Eisenhaur, David Bloom, Carsten Book, Wesley Garland, Igor Bukanov, moz_bug_r_a4, shutdown, Philip Taylor, tgirmann, Boris Zbarsky, Gerry Eisenhaur, Michal Zalewski, Gynvael Coldwind, regenrecht and iDefense Labs.

ChangeLog

2008-02-08 : Initial release
2008-02-20 : Updated Advisory
2008-02-27 : Updated Description

Vulnerability Management

Subscribe to VUPEN VNS and receive real-time alerts when new advisories or patches relevant to your systems and network configurations are available.

Feedback

If you have additional information or corrections for this security advisory please submit them via our contact form.