Sign Up for Your FREE Weekly SecurityTracker E-mail Alert Summary
|
|
|
|
|
|
|
Put SecurityTracker Vulnerability Alerts on Your Web Site -- It's Free!
|
|
|
|
Become a Partner and License Our Database or Notification Service
|
|
|
|
|
|
|
|
|
|
|
|
|
(Red Hat Issues Fix) Mozilla Thunderbird Bugs Let Remote Users Obtain Cookies and Execute Arbitrary Code
|
|
SecurityTracker Alert ID: 1025689 |
|
SecurityTracker URL: http://securitytracker.com/id/1025689
|
|
CVE Reference:
CVE-2011-0083, CVE-2011-0085, CVE-2011-2362, CVE-2011-2363, CVE-2011-2364, CVE-2011-2365, CVE-2011-2371, CVE-2011-2373, CVE-2011-2374, CVE-2011-2375, CVE-2011-2376, CVE-2011-2377
(Links to External Site)
|
Date: Jun 22 2011
|
Impact:
Execution of arbitrary code via network, User access via network
|
Fix Available: Yes Vendor Confirmed: Yes
|
Version(s): prior to 3.1.11
|
Description:
Multiple vulnerabilities were reported in Mozilla Thunderbird. A remote user can cause arbitrary code to be executed on the target user's system. A remote user can obtain cookies from another domain in certain cases.
A remote user can create specially crafted HTML that, when loaded by the target user, will trigger a memory corruption error and execute arbitrary code on the target system [CVE-2011-2364, CVE-2011-2374, CVE-2011-2375, CVE-2011-2376]. The code will run with the privileges of the target user.
Bob Clary, Kevin Brosnan, Nils, Gary Kwong, Jesse Ruderman, Christian Biesinger, Bas Schouten, Igor Bukanov, Bill McCloskey, Olli Pettay, Daniel Veditz, Marcia Knous, Luke Wagner, and secenv reported these vulnerabilities.
A remote user can create a specially crafted XUL document that, when loaded by the target user, will access deleted memory (while JavaScript is disabled) and potentially execute arbitrary code on the target system [CVE-2011-2373]. Martin Barbella reported this vulnerability.
A remote user can create multipart/x-mixed-replace images that, when loaded by the target user, will trigger a memory corruption error and execute arbitrary code [CVE-2011-2377]. Jordi Chancel reported this vulnerability.
A remote user can create a JavaScript Array object with the length set to an extremely large value and then call the reduceRight method to execute arbitrary code [CVE-2011-2371]. Chris Rohlf and Yan Ivnitskiy of Matasano Security reported this vulnerability.
A remote user can invoke a specially crafted XUL document that, when loaded by the target user, will trigger a dangling pointer error (use-after-free) and execute arbitrary code [CVE-2011-0083, CVE-2011-0085, CVE-2011-2363]. Firefox 3.x is affected. regenrecht reported this vulnerability via TippingPoint's Zero Day Initiative.
A remote user can set a cookie for a target domain followed by a period character (e.g., 'example.com.') to obtain cookies from another domain (e.g., 'example.com') [CVE-2011-2362]. Firefox 3.x is affected. Mozilla security researcher David Chan reported this vulnerability.
|
Impact:
A remote user can create HTML that, when loaded by the target user, will execute arbitrary code on the target user's system.
A remote user can obtain cookies from another domain in certain cases.
|
Solution:
Red Hat has issued a fix.
The Red Hat advisory is available at:
https://rhn.redhat.com/errata/RHSA-2011-0887.html
|
Vendor URL: www.mozilla.org/security/announce/2011/mfsa2011-19.html (Links to External Site)
|
Cause:
Access control error, Boundary error
|
Underlying OS:
Linux (Red Hat Enterprise)
|
|
Message History:
This archive entry is a follow-up to the message listed below.
|
Source Message Contents
|
Date: Tue, 21 Jun 2011 23:26:16 +0000
Subject: [RHSA-2011:0887-01] Critical: thunderbird security update
|
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
=====================================================================
Red Hat Security Advisory
Synopsis: Critical: thunderbird security update
Advisory ID: RHSA-2011:0887-01
Product: Red Hat Enterprise Linux
Advisory URL: https://rhn.redhat.com/errata/RHSA-2011-0887.html
Issue date: 2011-06-21
CVE Names: CVE-2011-0083 CVE-2011-0085 CVE-2011-2362
CVE-2011-2363 CVE-2011-2364 CVE-2011-2365
CVE-2011-2371 CVE-2011-2373 CVE-2011-2374
CVE-2011-2375 CVE-2011-2376 CVE-2011-2377
=====================================================================
1. Summary:
An updated thunderbird package that fixes several security issues is now
available for Red Hat Enterprise Linux 4 and 5.
The Red Hat Security Response Team has rated this update as having critical
security impact. Common Vulnerability Scoring System (CVSS) base scores,
which give detailed severity ratings, are available for each vulnerability
from the CVE links in the References section.
2. Relevant releases/architectures:
RHEL Optional Productivity Applications (v. 5 server) - i386, x86_64
Red Hat Enterprise Linux AS version 4 - i386, ia64, ppc, s390, s390x, x86_64
Red Hat Enterprise Linux Desktop (v. 5 client) - i386, x86_64
Red Hat Enterprise Linux Desktop version 4 - i386, x86_64
Red Hat Enterprise Linux ES version 4 - i386, ia64, x86_64
Red Hat Enterprise Linux WS version 4 - i386, ia64, x86_64
3. Description:
Mozilla Thunderbird is a standalone mail and newsgroup client.
A flaw was found in the way Thunderbird handled malformed JPEG images. An
HTML mail message containing a malicious JPEG image could cause Thunderbird
to crash or, potentially, execute arbitrary code with the privileges of the
user running Thunderbird. (CVE-2011-2377)
Multiple dangling pointer flaws were found in Thunderbird. Malicious HTML
content could cause Thunderbird to crash or, potentially, execute arbitrary
code with the privileges of the user running Thunderbird. (CVE-2011-0083,
CVE-2011-0085, CVE-2011-2363)
Several flaws were found in the processing of malformed HTML content.
Malicious HTML content could cause Thunderbird to crash or, potentially,
execute arbitrary code with the privileges of the user running Thunderbird.
(CVE-2011-2364, CVE-2011-2365, CVE-2011-2374, CVE-2011-2375, CVE-2011-2376)
An integer overflow flaw was found in the way Thunderbird handled
JavaScript Array objects. Malicious content could cause Thunderbird to
execute JavaScript with the privileges of the user running Thunderbird.
(CVE-2011-2371)
A use-after-free flaw was found in the way Thunderbird handled malformed
JavaScript. Malicious content could cause Thunderbird to execute JavaScript
with the privileges of the user running Thunderbird. (CVE-2011-2373)
It was found that Thunderbird could treat two separate cookies (for web
content) as interchangeable if both were for the same domain name but one
of those domain names had a trailing "." character. This violates the
same-origin policy and could possibly lead to data being leaked to the
wrong domain. (CVE-2011-2362)
All Thunderbird users should upgrade to this updated package, which
resolves these issues. All running instances of Thunderbird must be
restarted for the update to take effect.
4. Solution:
Before applying this update, make sure all previously-released errata
relevant to your system have been applied.
This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/kb/docs/DOC-11259
5. Bugs fixed (http://bugzilla.redhat.com/):
714576 - CVE-2011-2364, CVE-2011-2365, CVE-2011-2374, CVE-2011-2375, CVE-2011-2376 Mozilla Miscellaneous memory safety hazards (MFSA 2011-19)
714577 - CVE-2011-2373 Mozilla Use-after-free vulnerability when viewing XUL document with script disabled (MFSA 2011-20)
714580 - CVE-2011-2371 Mozilla Integer overflow and arbitrary code execution (MFSA 2011-22)
714581 - CVE-2011-0083 CVE-2011-0085 CVE-2011-2363 Mozilla Multiple dangling pointer vulnerabilities (MFSA 2011-23)
714583 - CVE-2011-2362 Mozilla Cookie isolation error (MFSA 2011-24)
714929 - CVE-2011-2377 Mozilla Crash caused by corrupted JPEG image (MFSA 2011-21)
6. Package List:
Red Hat Enterprise Linux AS version 4:
Source:
ftp://updates.redhat.com/enterprise/4AS/en/os/SRPMS/thunderbird-1.5.0.12-39.el4.src.rpm
i386:
thunderbird-1.5.0.12-39.el4.i386.rpm
thunderbird-debuginfo-1.5.0.12-39.el4.i386.rpm
ia64:
thunderbird-1.5.0.12-39.el4.ia64.rpm
thunderbird-debuginfo-1.5.0.12-39.el4.ia64.rpm
ppc:
thunderbird-1.5.0.12-39.el4.ppc.rpm
thunderbird-debuginfo-1.5.0.12-39.el4.ppc.rpm
s390:
thunderbird-1.5.0.12-39.el4.s390.rpm
thunderbird-debuginfo-1.5.0.12-39.el4.s390.rpm
s390x:
thunderbird-1.5.0.12-39.el4.s390x.rpm
thunderbird-debuginfo-1.5.0.12-39.el4.s390x.rpm
x86_64:
thunderbird-1.5.0.12-39.el4.x86_64.rpm
thunderbird-debuginfo-1.5.0.12-39.el4.x86_64.rpm
Red Hat Enterprise Linux Desktop version 4:
Source:
ftp://updates.redhat.com/enterprise/4Desktop/en/os/SRPMS/thunderbird-1.5.0.12-39.el4.src.rpm
i386:
thunderbird-1.5.0.12-39.el4.i386.rpm
thunderbird-debuginfo-1.5.0.12-39.el4.i386.rpm
x86_64:
thunderbird-1.5.0.12-39.el4.x86_64.rpm
thunderbird-debuginfo-1.5.0.12-39.el4.x86_64.rpm
Red Hat Enterprise Linux ES version 4:
Source:
ftp://updates.redhat.com/enterprise/4ES/en/os/SRPMS/thunderbird-1.5.0.12-39.el4.src.rpm
i386:
thunderbird-1.5.0.12-39.el4.i386.rpm
thunderbird-debuginfo-1.5.0.12-39.el4.i386.rpm
ia64:
thunderbird-1.5.0.12-39.el4.ia64.rpm
thunderbird-debuginfo-1.5.0.12-39.el4.ia64.rpm
x86_64:
thunderbird-1.5.0.12-39.el4.x86_64.rpm
thunderbird-debuginfo-1.5.0.12-39.el4.x86_64.rpm
Red Hat Enterprise Linux WS version 4:
Source:
ftp://updates.redhat.com/enterprise/4WS/en/os/SRPMS/thunderbird-1.5.0.12-39.el4.src.rpm
i386:
thunderbird-1.5.0.12-39.el4.i386.rpm
thunderbird-debuginfo-1.5.0.12-39.el4.i386.rpm
ia64:
thunderbird-1.5.0.12-39.el4.ia64.rpm
thunderbird-debuginfo-1.5.0.12-39.el4.ia64.rpm
x86_64:
thunderbird-1.5.0.12-39.el4.x86_64.rpm
thunderbird-debuginfo-1.5.0.12-39.el4.x86_64.rpm
Red Hat Enterprise Linux Desktop (v. 5 client):
Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Client/en/os/SRPMS/thunderbird-2.0.0.24-18.el5_6.src.rpm
i386:
thunderbird-2.0.0.24-18.el5_6.i386.rpm
thunderbird-debuginfo-2.0.0.24-18.el5_6.i386.rpm
x86_64:
thunderbird-2.0.0.24-18.el5_6.x86_64.rpm
thunderbird-debuginfo-2.0.0.24-18.el5_6.x86_64.rpm
RHEL Optional Productivity Applications (v. 5 server):
Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/os/SRPMS/thunderbird-2.0.0.24-18.el5_6.src.rpm
i386:
thunderbird-2.0.0.24-18.el5_6.i386.rpm
thunderbird-debuginfo-2.0.0.24-18.el5_6.i386.rpm
x86_64:
thunderbird-2.0.0.24-18.el5_6.x86_64.rpm
thunderbird-debuginfo-2.0.0.24-18.el5_6.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/#package
7. References:
https://www.redhat.com/security/data/cve/CVE-2011-0083.html
https://www.redhat.com/security/data/cve/CVE-2011-0085.html
https://www.redhat.com/security/data/cve/CVE-2011-2362.html
https://www.redhat.com/security/data/cve/CVE-2011-2363.html
https://www.redhat.com/security/data/cve/CVE-2011-2364.html
https://www.redhat.com/security/data/cve/CVE-2011-2365.html
https://www.redhat.com/security/data/cve/CVE-2011-2371.html
https://www.redhat.com/security/data/cve/CVE-2011-2373.html
https://www.redhat.com/security/data/cve/CVE-2011-2374.html
https://www.redhat.com/security/data/cve/CVE-2011-2375.html
https://www.redhat.com/security/data/cve/CVE-2011-2376.html
https://www.redhat.com/security/data/cve/CVE-2011-2377.html
https://access.redhat.com/security/updates/classification/#critical
8. Contact:
The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/
Copyright 2011 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.4 (GNU/Linux)
iD8DBQFOASiIXlSAg2UNWIIRAtZYAJ9ZBRu60zLLdoBrUyCrIZy0/phyMgCgky71
r+NwqFOqCUeak8TCpitMBnk=
=QSbg
-----END PGP SIGNATURE-----
--
Enterprise-watch-list mailing list
Enterprise-watch-list@redhat.com
https://www.redhat.com/mailman/listinfo/enterprise-watch-list
|
|
Go to the Top of This SecurityTracker Archive Page
|
