SecurityTracker.com
Keep Track of the Latest Vulnerabilities
with SecurityTracker!
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 
Sign Up
Sign Up for Your FREE Weekly SecurityTracker E-mail Alert Summary
Instant Alerts
Buy our Premium Vulnerability Notification Service to receive customized, instant alerts
Affiliates
Put SecurityTracker Vulnerability Alerts on Your Web Site -- It's Free!
Partners
Become a Partner and License Our Database or Notification Service
Report a Bug
Report a vulnerability that you have found to SecurityTracker
bugs
@
securitytracker.com






Category:   Application (E-mail Client)  >   Mozilla Thunderbird Vendors:   Mozilla.org
Mozilla Thunderbird Validation Error in IFRAME SRC Tag Lets Remote Users Execute Arbitrary Javascript
SecurityTracker Alert ID:  1015665
SecurityTracker URL:  http://securitytracker.com/id/1015665
CVE Reference:   GENERIC-MAP-NOMATCH   (Links to External Site)
Date:  Feb 22 2006
Impact:   Disclosure of user information, Execution of arbitrary code via network, Modification of user information, User access via network
Fix Available:  Yes  Vendor Confirmed:  Yes  Exploit Included:  Yes  
Version(s): 1.0.7 and prior versions
Description:   A vulnerability was reported in Mozilla Thunderbird. A remote user can cause arbitrary scripting code to be executed on the target user's system.

The software does not properly filter javascript from HTML tags. A remote user can send HTML-based e-mail with arbitrary javascript in the SRC attribute of the IFRAME tag. When the target user edits the message (when replying to the message, for example), the javascript will be executed, regardless of the javascript settings in the preferences.

A demonstration exploit is provided:

<html>
<body>
<iframe src="javascript:alert('Found by www.sysdream.com !')"></iframe>
</body>
</html>

nono2357 at sysdream dot com discovered this vulnerability.

Impact:   A remote user can cause arbitrary javascript to be executed on the target user's system.
Solution:   The vendor has issued a fixed version (1.5), available at:

http://www.mozilla.com/thunderbird/

Vendor URL:  www.mozilla.com/thunderbird/ (Links to External Site)
Cause:   Input validation error
Underlying OS:  Linux (Any), UNIX (Any), Windows (Any)

Message History:   None.


 Source Message Contents

Date:  Wed, 22 Feb 2006 15:42:19 +0100
Subject:  Mozilla Thunderbird : Remote Code Execution & Denial of Service

Mozilla Thunderbird : Remote Code Execution & Denial of Service

//----- Advisory


Program          : Mozilla Thunderbird
Homepage         : http://www.mozilla.com/thunderbird/
Tested version   : <= 1.0.7
Found by         : nono2357 at sysdream dot com
This advisory    : nono2357 at sysdream dot com
Discovery date   : 2006/01/28


//----- Application description


Full-Featured Email

Simple to use, powerful, and customizable, Thunderbird is a full-featured
email application. Thunderbird supports IMAP and POP mail protocols, as well
as HTML mail formatting. Easily import your existing email accounts and
messages. Built-in RSS capabilities, powerful quick search, spell check
as you
type, global inbox, deleting attachments and advanced message filtering
round
out Thunderbird's modern feature set.


//----- Description of vulnerability


Thunderbird's WYSIWYG rendering engine insufficiently filters javascript
scripts. It is possible to write javascript in the SRC attribute of the
IFRAME
tag. This leads to execution when the email is edited (for instance when
replying to the email), even if javascript is disabled in the preferences.


//----- Proof Of Concept


* Javascript execution :

<html>
<body>
<iframe src="javascript:alert('Found by www.sysdream.com !')"></iframe>
</body>
</html>

* Denial of service (application crash) :

<html>
<body>
<iframe src="javascript:parent.document.write('Found by www.sysdream.com
!')"></iframe>
</body>
</html>


//----- Solution


Upgrade to version 1.5.

Download page : http://www.mozilla.com/thunderbird/all.html
Direct link :
http://ftp.mozilla.org/pub/mozilla.org/thunderbird/releases/1.5/


//----- Impact


Successful exploitation may lead to information disclosure (application
version, platform, user emails, user preferences, ...) or could crash the
application.  


//----- Credits


http://www.sysdream.com
nono2357 at sysdream dot com


//----- Greetings


crashfr & the hackademy ...


 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

Copyright 2017, SecurityGlobal.net LLC