[NEWS] Mozilla Thunderbird MIME External-Body Heap Overflow Vulnerability

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html

- - - - - - - - -



Mozilla Thunderbird MIME External-Body Heap Overflow Vulnerability
------------------------------------------------------------------------


SUMMARY

<http://www.mozilla.com/en-US/thunderbird/> Mozilla Thunderbird is "an
open source electronic mail client and news reader. Multipurpose Internet
Message Extensions (MIME) is a standard that defines how non-text
attachments and other data are handled in electronic mail. The
external-body MIME type is used for retrieving a resource that is
referenced in the message, such as an attachment". Remote exploitation of
a heap based buffer overflow vulnerability in Mozilla Organization's
Thunderbird could allow an attacker to execute arbitrary code with the
privileges of the current user.

DETAILS

Vulnerable Systems:
* Thunderbird version 2.0.0.9

Immune Systems:
* Thunderbird version 2.0.0.12

The vulnerability exists when parsing the external-body MIME type in an
electronic mail. When calculating the number of bytes to allocate for a
heap buffer, sufficient space is not reserved for all of the data being
copied into the buffer. This results in up to 3 bytes of the buffer being
overflowed, potentially allowing for the execution of arbitrary code.

Analysis:
Exploitation of this vulnerability results in the execution of arbitrary
code with the privileges of the user running Thunderbird. Exploitation
requires that an attacker social engineers a user into viewing a malicious
message in Thunderbird. If the 'View->Message Pane' option is turned on
(the "Preview" pane), which is the default, then all a targeted user has
to do is select the message in the browsing pane. Once the message is
previewed, the vulnerability will be triggered.

Workaround:
Setting the "mailnews.display.disallow_mime_handlers" configuration
property to any value >= 3 will prevent the vulnerable code from being
triggered.

Vendor response:
The Mozilla Foundation has addressed this vulnerability by releasing
version 2.0.0.12 of Thunderbird. For more information, refer to their
advisory at the following URL:
<http://www.mozilla.org/security/announce/2008/mfsa2008-12.html>
http://www.mozilla.org/security/announce/2008/mfsa2008-12.html

CVE Information:
<http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0304>
CVE-2008-0304

Disclosure Timeline:
01/14/2008 - Initial vendor notification
01/14/2008 - Initial vendor response
02/26/2008 - Coordinated public disclosure


ADDITIONAL INFORMATION

The information has been provided by iDefense Labs.
The original article can be found at:
<http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=668>
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=668



========================================


This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@xxxxxxxxxxxxxx
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@xxxxxxxxxxxxxx


====================
====================

DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

Relevant Pages

  • [UNIX] Sun Microsystems Solaris srsexec Format String Vulnerability
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Sun Microsystems Solaris srsexec Format String Vulnerability ... all of the client machines being monitored and is set-uid root by default. ... attackers to execute arbitrary code with root privileges. ...
    (Securiteam)
  • [UNIX] Multiple UNIX/Linux Vendor Xpdf makeFileKey2 Stack Overflow
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Remote exploitation of a buffer overflow vulnerability in the xpdf PDF ... arbitrary code execution as the user viewing a PDF file. ...
    (Securiteam)
  • [NT] Cisco Call Manager CTLProvider Heap Overflow Vulnerability
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Cisco Call Manager CTLProvider Heap Overflow Vulnerability ... This can lead to arbitrary code execution. ... This will continue until heap chunks are overwritten at the users control, ...
    (Securiteam)
  • [NEWS] Macromedia JRun Web Server URL Parsing Buffer Overflow
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Macromedia JRun Web Server URL Parsing Buffer Overflow ... Remote exploitation of a buffer overflow vulnerability in Macromedia JRun ... potentially allowing the execution of arbitrary code. ...
    (Securiteam)
  • [NEWS] Gecko Based Browsers CSS Letter-Spacing Integer Overflow
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Firefox version 1.5.0.1 and prior ... Thunderbird version 1.5 and above ... This vulnerability allows attackers to execute arbitrary code on ...
    (Securiteam)