Mozilla Thunderbird and SeaMonkey email messages integer overflow
| mozilla-email-messages-overflow (32810) |  High Risk |
Description:
Mozilla Thunderbird and SeaMonkey could allow a remote attacker to execute arbitrary code on the system, caused by an integer overflow when processing enhanced or richtext email messages. A remote attacker could exploit this vulnerability by creating a specially-crafted message containing an overly long string and persuading a victim to open the specially-crafted email message.
Note: Many email servers have storage restrictions or transport filters which prevent an overly large message from passing through.
Platforms Affected:
- Debian, Debian Linux 3.1
- Gentoo, Linux
- Mozilla, SeaMonkey 1.0 Beta
- Mozilla, SeaMonkey 1.0 Alpha
- Mozilla, SeaMonkey 1.0 Dev
- Mozilla, SeaMonkey 1.0
- Mozilla, SeaMonkey 1.0.1
- Mozilla, SeaMonkey 1.0.2
- Mozilla, SeaMonkey 1.0.3
- Mozilla, SeaMonkey 1.0.4
- Mozilla, SeaMonkey 1.0.5
- Mozilla, SeaMonkey 1.0.6
- Mozilla, SeaMonkey 1.0.7
- Mozilla, Thunderbird 0.1
- Mozilla, Thunderbird 0.2
- Mozilla, Thunderbird 0.3
- Mozilla, Thunderbird 0.4
- Mozilla, Thunderbird 0.5
- Mozilla, Thunderbird 0.6
- Mozilla, Thunderbird 0.7
- Mozilla, Thunderbird 0.7.1
- Mozilla, Thunderbird 0.7.2
- Mozilla, Thunderbird 0.7.3
- Mozilla, Thunderbird 0.8
- Mozilla, Thunderbird 0.9
- Mozilla, Thunderbird 1.0
- Mozilla, Thunderbird 1.0.1
- Mozilla, Thunderbird 1.0.2
- Mozilla, Thunderbird 1.0.3
- Mozilla, Thunderbird 1.0.4
- Mozilla, Thunderbird 1.0.5
- Mozilla, Thunderbird 1.0.5 Beta
- Mozilla, Thunderbird 1.0.6
- Mozilla, Thunderbird 1.0.7
- Mozilla, Thunderbird 1.5 Beta2
- Mozilla, Thunderbird 1.5
- Mozilla, Thunderbird 1.5.0.1
- Mozilla, Thunderbird 1.5.0.2
- Mozilla, Thunderbird 1.5.0.3
- Mozilla, Thunderbird 1.5.0.4
- Mozilla, Thunderbird 1.5.0.5
- Mozilla, Thunderbird 1.5.0.6
- Mozilla, Thunderbird 1.5.0.7
- Mozilla, Thunderbird 1.5.0.8
- Mozilla, Thunderbird 1.5.0.9
- RedHat, Enterprise Linux 2.1 WS
- RedHat, Enterprise Linux 2.1 ES
- RedHat, Enterprise Linux 2.1 AS
- RedHat, Enterprise Linux 3 WS
- RedHat, Enterprise Linux 3 ES
- RedHat, Enterprise Linux 3 Desktop
- RedHat, Enterprise Linux 3 AS
- RedHat, Enterprise Linux 4 Desktop
- RedHat, Enterprise Linux 4 ES
- RedHat, Enterprise Linux 4 WS
- RedHat, Enterprise Linux 4 AS
- RedHat, Enterprise Linux 5 Client
- RedHat, Enterprise Linux Optional Productivity Applications 5 Server
- RedHat, Linux Advanced Workstation 2.1 Itanium
Remedy:
For Thunderbird:
Upgrade to the latest version (1.5.0.10 or later), available from the Mozilla Web site. See References.
For SeaMonkey:
Upgrade to the latest version (1.0.8 or later), available from Mozilla.org. See References.
For Gentoo Linux:
Refer to Gentoo Linux Security Announcement GLSA 200703-18 for patch, upgrade, or suggested workaround information. See References.
For Red Hat Linux (Thunderbird):
Refer to RHSA-2007:0078-2 for patch, upgrade, or suggested workaround information. See References.
For Debian Linux (mozilla-firefox):
Refer to DSA-1336-1 for patch, upgrade, or suggested workaround information. See References.
For other distributions:
Contact your vendor for upgrade or patch information.
Consequences:
Gain Access
References:
- MFSA 2007-10, Potential integer overflow with text/enhanced mail at http://www.mozilla.org/security/announce/2007/mfsa2007-10.html.
- Mozilla Web site, Thunderbird 1.5 at http://www.mozilla.com/en-US/thunderbird/.
- Mozilla.org, The SeaMonkey Project at http://www.mozilla.org/projects/seamonkey/.
- BID-22845: Mozilla Thunderbird/Seamonkey Rich Text Integer Overflow Vulnerability
- CVE-2007-1282: Integer overflow in Mozilla Thunderbird before 1.5.0.10 and SeaMonkey before 1.0.8 allows remote attackers to trigger a buffer overflow and possibly execute arbitrary code via a text/enhanced or text/richtext e-mail message with an extremely long line.
- DSA-1336: mozilla-firefox -- several vulnerabilities
- FrSIRT/ADV-2007-0824: Mozilla Thunderbird and SeaMonkey Email Handling Remote Code Execution Vulnerability
- GLSA-200703-18: Mozilla Thunderbird: Multiple vulnerabilities
- RHSA-2007-0077: Critical: seamonkey security update
- RHSA-2007-0078: Critical: thunderbird security update
- RHSA-2007-0108: Critical: thunderbird security update
Reported:
Mar 05, 2007
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
Copyright (c) 1994-2008 Internet Security Systems, Inc. All rights reserved worldwide.
For corrections or additions please email xforce@iss.net