Anfälligkeitssuche        Suche in 219043 CVE Beschreibungen
und 99761 Test Beschreibungen,
Zugriff auf 10,000+ Quellverweise.
Tests   CVE   Alle  

Test Kennung:1.3.6.1.4.1.25623.1.0.57412
Kategorie:Ubuntu Local Security Checks
Titel:Ubuntu USN-352-1 (mozilla-thunderbird)
Zusammenfassung:NOSUMMARY
Beschreibung:Description:

The remote host is missing an update to mozilla-thunderbird
announced via advisory USN-352-1.

A security issue affects the following Ubuntu releases:

Ubuntu 6.06 LTS

This advisory also applies to the corresponding versions of
Kubuntu, Edubuntu, and Xubuntu.

Various flaws have been reported that allow an attacker to execute
arbitrary code with user privileges by tricking the user into opening
a malicious email containing JavaScript. Please note that JavaScript
is disabled by default for emails, and it is not recommended to enable
it. (CVE-2006-4253, CVE-2006-4565, CVE-2006-4566, CVE-2006-4571)

The NSS library did not sufficiently check the padding of PKCS #1 v1.5
signatures if the exponent of the public key is 3 (which is widely
used for CAs). This could be exploited to forge valid signatures
without the need of the secret key. (CVE-2006-4340)

Jon Oberheide reported a way how a remote attacker could trick users
into downloading arbitrary extensions with circumventing the normal
SSL certificate check. The attacker would have to be in a position to
spoof the victim's DNS, causing them to connect to sites of the
attacker's choosing rather than the sites intended by the victim. If
they gained that control and the victim accepted the attacker's cert
for the Mozilla update site, then the next update check could be
hijacked and redirected to the attacker's site without
detection. (CVE-2006-4567)

Georgi Guninski discovered that even with JavaScript disabled, a
malicous email could still execute JavaScript when the message is
viewed, replied to, or forwarded by putting the script in a remote XBL
file loaded by the message. (CVE-2006-4570)

Solution:
The problem can be corrected by upgrading your system to the
following package versions:

Ubuntu 6.06 LTS:
mozilla-thunderbird 1.5.0.7-0ubuntu0.6.06

After a standard system upgrade you need to restart Thunderbird to
effect the necessary changes.

http://www.securityspace.com/smysecure/catid.html?in=USN-352-1

Risk factor : Critical

CVSS Score:
10.0

Querverweis: Common Vulnerability Exposure (CVE) ID: CVE-2006-4253
BugTraq ID: 19488
http://www.securityfocus.com/bid/19488
BugTraq ID: 19534
http://www.securityfocus.com/bid/19534
Bugtraq: 20060812 Concurrency-related vulnerabilities in browsers - expect problems (Google Search)
http://www.securityfocus.com/archive/1/443020/100/100/threaded
Bugtraq: 20061006 Re: Concurrency-related vulnerabilities in browsers - expect problems (Google Search)
http://www.securityfocus.com/archive/1/443306/100/100/threaded
Bugtraq: 20060817 RE: [VulnWatch] Re: Concurrency-related vulnerabilities in browsers - expect problems (Google Search)
http://www.securityfocus.com/archive/1/443528/100/0/threaded
Bugtraq: 20060817 Re: [VulnWatch] Re: Concurrency-related vulnerabilities in browsers - expect problems (Google Search)
http://www.securityfocus.com/archive/1/443500/100/100/threaded
Bugtraq: 20060915 rPSA-2006-0169-1 firefox thunderbird (Google Search)
http://www.securityfocus.com/archive/1/446140/100/0/threaded
http://www.securityfocus.com/archive/1/447840/100/200/threaded
http://www.securityfocus.com/archive/1/447837/100/200/threaded
Bugtraq: 20061017 Flaw in Firefox 2.0 RC2 (Google Search)
http://www.securityfocus.com/archive/1/448956/100/100/threaded
Bugtraq: 20061019 Re: Flaw in Firefox 2.0 RC2 (Google Search)
http://www.securityfocus.com/archive/1/448984/100/100/threaded
http://www.securityfocus.com/archive/1/449245/100/100/threaded
Bugtraq: 20061023 Flaw in Firefox 2.0 Final (Google Search)
http://www.securityfocus.com/archive/1/449487/100/0/threaded
Bugtraq: 20061025 Mozilla Firefox JavaScript Handler Race Condition Memory Corruption Vulnerability (Google Search)
http://www.securityfocus.com/archive/1/449726/100/0/threaded
http://security.gentoo.org/glsa/glsa-200609-19.xml
http://security.gentoo.org/glsa/glsa-200610-01.xml
http://security.gentoo.org/glsa/glsa-200610-04.xml
HPdes Security Advisory: HPSBUX02153
http://www1.itrc.hp.com/service/cki/docDisplay.do?docId=c00771742
HPdes Security Advisory: SSRT061181
http://www.mandriva.com/security/advisories?name=MDKSA-2006:168
http://www.mandriva.com/security/advisories?name=MDKSA-2006:169
http://lcamtuf.coredump.cx/ffoxdie.html
http://lcamtuf.coredump.cx/ffoxdie3.html
http://www.pianetapc.it/view.php?id=770
http://www.securiteam.com/securitynews/5VP0M0AJFW.html
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9528
http://www.redhat.com/support/errata/RHSA-2006-0675.html
http://www.redhat.com/support/errata/RHSA-2006-0676.html
http://www.redhat.com/support/errata/RHSA-2006-0677.html
http://securitytracker.com/id?1016846
http://securitytracker.com/id?1016847
http://securitytracker.com/id?1016848
http://secunia.com/advisories/21513
http://secunia.com/advisories/21906
http://secunia.com/advisories/21915
http://secunia.com/advisories/21916
http://secunia.com/advisories/21939
http://secunia.com/advisories/21940
http://secunia.com/advisories/21949
http://secunia.com/advisories/21950
http://secunia.com/advisories/22001
http://secunia.com/advisories/22025
http://secunia.com/advisories/22036
http://secunia.com/advisories/22055
http://secunia.com/advisories/22056
http://secunia.com/advisories/22066
http://secunia.com/advisories/22074
http://secunia.com/advisories/22088
http://secunia.com/advisories/22195
http://secunia.com/advisories/22210
http://secunia.com/advisories/22274
http://secunia.com/advisories/22391
http://secunia.com/advisories/22422
http://secunia.com/advisories/24711
SGI Security Advisory: 20060901-01-P
ftp://patches.sgi.com/support/free/security/advisories/20060901-01-P.asc
SuSE Security Announcement: SUSE-SA:2006:054 (Google Search)
http://www.novell.com/linux/security/advisories/2006_54_mozilla.html
http://www.ubuntu.com/usn/usn-350-1
http://www.ubuntu.com/usn/usn-351-1
http://www.ubuntu.com/usn/usn-352-1
http://www.ubuntu.com/usn/usn-354-1
http://www.vupen.com/english/advisories/2006/3617
http://www.vupen.com/english/advisories/2006/3748
http://www.vupen.com/english/advisories/2007/1198
http://www.vupen.com/english/advisories/2008/0083
Common Vulnerability Exposure (CVE) ID: CVE-2006-4340
Cert/CC Advisory: TA06-312A
http://www.us-cert.gov/cas/techalerts/TA06-312A.html
Debian Security Information: DSA-1191 (Google Search)
http://www.us.debian.org/security/2006/dsa-1191
Debian Security Information: DSA-1192 (Google Search)
http://www.debian.org/security/2006/dsa-1192
Debian Security Information: DSA-1210 (Google Search)
http://www.debian.org/security/2006/dsa-1210
http://www.gentoo.org/security/en/glsa/glsa-200610-06.xml
http://www.matasano.com/log/469/many-rsa-signatures-may-be-forgeable-in-openssl-and-elsewhere/
http://www.mozilla.org/security/announce/2006/mfsa2006-66.html
http://www.imc.org/ietf-openpgp/mail-archive/msg14307.html
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11007
http://securitytracker.com/id?1016858
http://securitytracker.com/id?1016859
http://securitytracker.com/id?1016860
http://secunia.com/advisories/21903
http://secunia.com/advisories/22044
http://secunia.com/advisories/22226
http://secunia.com/advisories/22247
http://secunia.com/advisories/22299
http://secunia.com/advisories/22342
http://secunia.com/advisories/22446
http://secunia.com/advisories/22849
http://secunia.com/advisories/22992
http://secunia.com/advisories/23883
http://sunsolve.sun.com/search/document.do?assetkey=1-26-102648-1
http://sunsolve.sun.com/search/document.do?assetkey=1-26-102781-1
SuSE Security Announcement: SUSE-SA:2006:055 (Google Search)
http://www.novell.com/linux/security/advisories/2006_55_ssl.html
http://www.ubuntu.com/usn/usn-361-1
http://www.vupen.com/english/advisories/2006/3622
http://www.vupen.com/english/advisories/2006/3899
http://www.vupen.com/english/advisories/2007/0293
XForce ISS Database: mozilla-nss-security-bypass(30098)
https://exchange.xforce.ibmcloud.com/vulnerabilities/30098
Common Vulnerability Exposure (CVE) ID: CVE-2006-4565
BugTraq ID: 20042
http://www.securityfocus.com/bid/20042
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11421
XForce ISS Database: mozilla-javascript-expression-bo(28955)
https://exchange.xforce.ibmcloud.com/vulnerabilities/28955
Common Vulnerability Exposure (CVE) ID: CVE-2006-4566
CERT/CC vulnerability note: VU#141528
http://www.kb.cert.org/vuls/id/141528
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9637
XForce ISS Database: mozilla-backslash-dos(28958)
https://exchange.xforce.ibmcloud.com/vulnerabilities/28958
Common Vulnerability Exposure (CVE) ID: CVE-2006-4567
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10488
http://securitytracker.com/id?1016850
http://securitytracker.com/id?1016851
XForce ISS Database: mozilla-auto-update-gain-access(28950)
https://exchange.xforce.ibmcloud.com/vulnerabilities/28950
Common Vulnerability Exposure (CVE) ID: CVE-2006-4570
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10892
http://securitytracker.com/id?1016866
http://securitytracker.com/id?1016867
XForce ISS Database: thunderbird-seamonkey-xbl-code-execution(28962)
https://exchange.xforce.ibmcloud.com/vulnerabilities/28962
Common Vulnerability Exposure (CVE) ID: CVE-2006-4571
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11728
CopyrightCopyright (c) 2006 E-Soft Inc. http://www.securityspace.com

Dies ist nur einer von 99761 Anfälligkeitstests in unserem Testpaket. Finden Sie mehr über unsere vollständigen Sicherheitsüberprüfungen heraus.

Um einen gratis Test für diese Anfälligkeit auf Ihrem System durchlaufen zu lassen, registrieren Sie sich bitte unten.




© 1998-2024 E-Soft Inc. Alle Rechte vorbehalten.