Mozilla Thunderbird attachment extension spoofing
| thunderbird-attachment-ext-spoofing (24164) |  Medium Risk |
Description:
Mozilla Thunderbird could allow a remote attacker to spoof email file attachments and trick user's into saving or opening malicious files. A remote attacker could exploit this vulnerability by creating an attachment with a specially-crafted file name and a Content-Type header that does not match the file extension, which would cause the actual file type to be hidden from the victim.
Consequences:
Bypass Security
Remedy:
Upgrade to the latest version of Thunderbird (1.5 or later), available from the Mozilla Web site. See References.
References:
- Mozilla Bugzilla Bug 300246: Spoofing via attachment dragging.
- Mozilla Web site: Thunderbird -- Reclaim your inbox.
- BID-16271: Mozilla Thunderbird File Attachment Spoofing Vulnerability
- CVE-2006-0236: GUI display truncation vulnerability in Mozilla Thunderbird 1.0.2, 1.0.6, and 1.0.7 allows user-assisted attackers to execute arbitrary code via an attachment with a filename containing a large number of spaces ending with a dangerous extension that is not displayed by Thunderbird, along with an inconsistent Content-Type header, which could be used to trick a user into downloading dangerous content by dragging or saving the attachment.
- MDKSA-2006:021: Updated mozilla-thunderbird packages fix vulnerability
- SA15907: Mozilla Thunderbird Multiple Vulnerabilities
- VUPEN/ADV-2006-0230: Mozilla Thunderbird Attachment Extension and Type Spoofing Vulnerability
Platforms Affected:
- MandrakeSoft Mandrake Linux 2006 X86_64
- MandrakeSoft Mandrake Linux 2006
- Mozilla Thunderbird 1.0.1
- Mozilla Thunderbird 1.0.2
- Mozilla Thunderbird 1.0.3
- Mozilla Thunderbird 1.0.4
- Mozilla Thunderbird 1.0.5
- Mozilla Thunderbird 1.0.6
- Mozilla Thunderbird 1.0.7
- Mozilla Thunderbird 1.5 Beta2
Reported:
Jan 17, 2006
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email xforce@iss.net