======================================================================
Secunia Research 17/01/2006
- Mozilla Thunderbird Attachment Spoofing Vulnerability -
======================================================================
Table of Contents
Affected Software....................................................1
Severity.............................................................2
Description of Vulnerability.........................................3
Solution.............................................................4
Time Table...........................................................5
Credits..............................................................6
References...........................................................7
About Secunia........................................................8
Verification.........................................................9
======================================================================
1) Affected Software
Mozilla Thunderbird versions 1.0.2, 1.0.6,
and 1.0.7 for Microsoft Windows.
Other versions may also be affected.
======================================================================
2) Severity
Rating: Less critical
Impact: Spoofing
System access
Where: From remote
======================================================================
3) Description of Vulnerability
Secunia Research has discovered a vulnerability in Thunderbird, which
can be exploited by malicious people to trick users into executing
arbitrary programs.
The vulnerability is caused due to attachments not being displayed
correctly in mails. This can be exploited to spoof the file extension
and the associated file type icon via a combination of overly long
filenames containing whitespaces and "Content-Type" headers not
matching the file extension.
Successful exploitation may lead to malware being saved to e.g. the
desktop.
NOTE: Attachments can be saved by dragging the attachment, or using
the "Save As..." or "Save All..." functionality. For files on the
desktop the icon can be spoofed if it e.g. is a ".exe" or
".lnk" file.
The vulnerability has been confirmed in versions 1.0.2, 1.0.6, and
1.0.7 for Microsoft Windows. Other versions may also be affected.
======================================================================
4) Solution
Update to version 1.5.
http://www.mozilla.com/thunderbird/
======================================================================
5) Time Table
01/07/2005 - Initial vendor notification.
10/07/2005 - Vendor confirms the vulnerability.
27/07/2005 - Vulnerability fixed in the CVS repository.
12/01/2006 - Thunderbird 1.5 released.
17/01/2006 - Public disclosure.
======================================================================
6) Credits
Discovered by Andreas Sandblad, Secunia Research.
======================================================================
7) References
https://bugzilla.mozilla.org/show_bug.cgi?id=300246
======================================================================
8) About Secunia
Secunia collects, validates, assesses, and writes advisories regarding
all the latest software vulnerabilities disclosed to the public. These
advisories are gathered in a publicly available database at the
Secunia web site:
http://secunia.com/
Secunia offers services to our customers enabling them to receive all
relevant vulnerability information to their specific system
configuration.
Secunia offers a FREE mailing list called Secunia Security Advisories:
http://secunia.com/secunia_security_advisories/
======================================================================
9) Verification
Please verify this advisory by visiting the Secunia web site:
http://secunia.com/secunia_research/2005-22/advisory/
Complete list of vulnerability reports released by Secunia Research:
http://secunia.com/secunia_research/
=====================================================================
