|
Brought to you by:
Suppliers of:
|
|
|
| |
| Mozilla Thunderbird displays display attachments in a wrongful manner which allows attackers to spoof attachments and convince users to execute arbitrary programs. |
| |
Credit:
The information has been provided by Secunia Research.
The original article can be found at: http://secunia.com/secunia_research/2005-22/advisory/
The bug report can be found at: https://bugzilla.mozilla.org/show_bug.cgi?id=300246
|
| |
Vulnerable Systems:
* Mozilla Thunderbird version 1.0.2
* Mozilla Thunderbird version 1.0.6
* Mozilla Thunderbird version 1.0.7
Immune Systems:
* Mozilla Thunderbird version 1.5
The vulnerability is caused due to attachments not being displayed correctly in mails. This can be exploited to spoof the file extension and the associated file type icon via a combination of overly long
filenames containing whitespaces and "Content-Type" headers not matching the file extension.
Successful exploitation may lead to malware being saved to e.g. the desktop.
NOTE: Attachments can be saved by dragging the attachment, or using the "Save As..." or "Save All..." functionality. For files on the desktop the icon can be spoofed if it e.g. is a ".exe" or ".lnk" file.
Disclosure Timeline:
01/07/2005 - Initial vendor notification.
10/07/2005 - Vendor confirms the vulnerability.
27/07/2005 - Vulnerability fixed in the CVS repository.
12/01/2006 - Thunderbird 1.5 released.
17/01/2006 - Public disclosure.
|
|
|
|
|
