Re: Mozilla protocol abuse

Since I published this report it has come to my attention that Thunderbird 1.5, unlike Thunderbird 2.0, has not been patched with the "osint" security flag. As such all Thunderbird 1.5 users are vulnerable against this attack and those exploits. Now would be a good time to upgrade to Thunderbird 2.0.

http://larholm.com/2007/07/26/thunderbird-15-has-not-been-patched-with-osint/

Regards
Thor Larholm


Thor Larholm wrote:
The Mozilla application platform currently has an unpatched input validation flaw which allows you to specify arbitrary command line arguments to any registered URL protocol handler process. Jesper Johansson already detailed parts of this on his blog on July 20, http://msinfluentials.com/blogs/jesper/. I wrote a vulnerability report on July 18 together with a proof-of-concept exploit that targeted Thunderbird 2.0.0.4.

Thunderbird 2.0.0.5 was released on July 19 and incidentally fixed this specific attack vector through its "osint" command line flag. It is now 6 days later and people should have had time to update their Thunderbird installations, so I have decided to publish my vulnerability report together with the exploits as they detail how to handle XPI exploitation.

The HTML version can be found at

http://larholm.com/2007/07/25/mozilla-protocol-abuse/

A ZIP file with the report and the XPI exploits can be found at

http://larholm.com/media/2007/7/mozillaprotocolabuse.zip

Cheers
Thor Larholm

Relevant Pages

  • Re: FW: [SLE] rejected email to list
    ... mine, at least, not on yours if you don't report it. ... I don't think you can do any thing about those, except convincing your ISP ... > Evolution to Thunderbird and import to Thunderbird from Evolution? ...
    (SuSE)
  • Re: [opensuse] Milestone 1 openSUSE 12.2 - my comments on it - UPDATE RE COLLUSION ADDON FOR
    ... Then I decided to try to see if Collusion would crash FF. ... FF installed from openSUSE crashes with Collusion but FF from Mozilla.org is ... I am not sure that such a report is warranted to bugzilla as it may well be anther "incompatible" add-on with the problem caused at the add-on's end. ... But regarding reporting bugs, one of the very nice features of Mozilla, both Firefox and Thunderbird, is that both automatically generate a bug report when either has a problem and which is sent when you go to restart the application. ...
    (SuSE)
  • Re: [Full-disclosure] Mozilla protocol abuse
    ... Since I published this report it has come to my attention that ... Thunderbird 1.5, unlike Thunderbird 2.0, has not been patched with the ... "osint" security flag. ... this specific attack vector through its "osint" command line flag. ...
    (Full-Disclosure)
  • Re: Email & Vista
    ... Mothy wrote: ... replacement for Thunderbird?" ... I'll report back as and when. ...
    (uk.people.silversurfers)