Mozilla Thunderbird javascript: URL launches default handler

thunderbird-javascript-handler-launch (19173) The risk level is classified as MediumMedium Risk

Description:

Thunderbird versions prior to 0.9 running on Microsoft Windows uses the system's default handler to load javascript: URLs, which could expose Thunderbird to other browser's vulnerabilities.

Platforms Affected:

  • Mozilla, Thunderbird 0.1
  • Mozilla, Thunderbird 0.2
  • Mozilla, Thunderbird 0.3
  • Mozilla, Thunderbird 0.4
  • Mozilla, Thunderbird 0.5
  • Mozilla, Thunderbird 0.6
  • Mozilla, Thunderbird 0.7
  • Mozilla, Thunderbird 0.7.1
  • Mozilla, Thunderbird 0.7.2
  • Mozilla, Thunderbird 0.7.3
  • Mozilla, Thunderbird 0.8

Remedy:

For Thunderbird:
Upgrade to the latest version (1.0 or later), available from the Mozilla Web site. See References.

Consequences:

Other

References:

  • MFSA 2005-10, javascript links in Thunderbird launch Internet Explorer at http://www.mozilla.org/security/announce/mfsa2005-10.html.
  • Mozilla Web site, Firefox at http://www.mozilla.org/products/firefox/.
  • BID-12407: Multiple Mozilla/Firefox/Thunderbird Vulnerabilities
  • CVE-2005-0148: Thunderbird before 0.9, when running on Windows systems, uses the default handler when processing javascript: links, which invokes Internet Explorer and may expose the Thunderbird user to vulnerabilities in the version of Internet Explorer that is installed on the user's system. NOTE: since the invocation between multiple products is a common practice, and the vulnerabilities inherent in multi-product interactions are not easily enumerable, this issue might be REJECTED in the future.

Reported:

Jan 31, 2005

The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.

For corrections or additions please email xforce@iss.net

Return to the main page