Mozilla Thunderbird Attachment Spoofing Vulnerability
18 Jan. 2006
Summary
Mozilla Thunderbird displays display attachments in a wrongful manner which allows attackers to spoof attachments and convince users to execute arbitrary programs.
Vulnerable Systems:
* Mozilla Thunderbird version 1.0.2
* Mozilla Thunderbird version 1.0.6
* Mozilla Thunderbird version 1.0.7
Immune Systems:
* Mozilla Thunderbird version 1.5
The vulnerability is caused due to attachments not being displayed correctly in mails. This can be exploited to spoof the file extension and the associated file type icon via a combination of overly long
filenames containing whitespaces and "Content-Type" headers not matching the file extension.
Successful exploitation may lead to malware being saved to e.g. the desktop.
NOTE: Attachments can be saved by dragging the attachment, or using the "Save As..." or "Save All..." functionality. For files on the desktop the icon can be spoofed if it e.g. is a ".exe" or ".lnk" file.
Disclosure Timeline:
01/07/2005 - Initial vendor notification.
10/07/2005 - Vendor confirms the vulnerability.
27/07/2005 - Vulnerability fixed in the CVS repository.
12/01/2006 - Thunderbird 1.5 released.
17/01/2006 - Public disclosure.
