English | Deutsch | Español | Português
 UserID:
 Passwd:
new user
 About:   Dedicated  | Advanced  | Standard  | Recurring  | No Risk  | Desktop  | Basic  | Single  | Security Seal  | FAQ
  Price/Feature Summary  | Order  | New Vulnerabilities  | Confidentiality  | Vulnerability Search
 Vulnerability   
Search   
    Search 61204 CVE descriptions
and 32582 test descriptions,
access 10,000+ cross references.
Tests   CVE   All  

Test ID:1.3.6.1.4.1.25623.1.0.57412
Category:Ubuntu Local Security Checks
Title:Ubuntu USN-352-1 (mozilla-thunderbird)
Summary:Ubuntu USN-352-1 (mozilla-thunderbird)
Description:
The remote host is missing an update to mozilla-thunderbird
announced via advisory USN-352-1.

A security issue affects the following Ubuntu releases:

Ubuntu 6.06 LTS

This advisory also applies to the corresponding versions of
Kubuntu, Edubuntu, and Xubuntu.

Various flaws have been reported that allow an attacker to execute
arbitrary code with user privileges by tricking the user into opening
a malicious email containing JavaScript. Please note that JavaScript
is disabled by default for emails, and it is not recommended to enable
it. (CVE-2006-4253, CVE-2006-4565, CVE-2006-4566, CVE-2006-4571)

The NSS library did not sufficiently check the padding of PKCS #1 v1.5
signatures if the exponent of the public key is 3 (which is widely
used for CAs). This could be exploited to forge valid signatures
without the need of the secret key. (CVE-2006-4340)

Jon Oberheide reported a way how a remote attacker could trick users
into downloading arbitrary extensions with circumventing the normal
SSL certificate check. The attacker would have to be in a position to
spoof the victim's DNS, causing them to connect to sites of the
attacker's choosing rather than the sites intended by the victim. If
they gained that control and the victim accepted the attacker's cert
for the Mozilla update site, then the next update check could be
hijacked and redirected to the attacker's site without
detection. (CVE-2006-4567)

Georgi Guninski discovered that even with JavaScript disabled, a
malicous email could still execute JavaScript when the message is
viewed, replied to, or forwarded by putting the script in a remote XBL
file loaded by the message. (CVE-2006-4570)

Solution:
The problem can be corrected by upgrading your system to the
following package versions:

Ubuntu 6.06 LTS:
mozilla-thunderbird 1.5.0.7-0ubuntu0.6.06

After a standard system upgrade you need to restart Thunderbird to
effect the necessary changes.

http://www.securityspace.com/smysecure/catid.html?in=USN-352-1

Risk factor : Critical
Cross-Ref: Common Vulnerability Exposure (CVE) ID: CVE-2006-4253
Bugtraq: 20060812 Concurrency-related vulnerabilities in browsers - expect problems (Google Search)
http://www.securityfocus.com/archive/1/archive/1/443020/100/100/threaded
Bugtraq: 20061006 Re: Concurrency-related vulnerabilities in browsers - expect problems (Google Search)
http://www.securityfocus.com/archive/1/443306/100/100/threaded
Bugtraq: 20060817 RE: [VulnWatch] Re: Concurrency-related vulnerabilities in browsers - expect problems (Google Search)
http://www.securityfocus.com/archive/1/archive/1/443528/100/0/threaded
Bugtraq: 20060817 Re: [VulnWatch] Re: Concurrency-related vulnerabilities in browsers - expect problems (Google Search)
http://www.securityfocus.com/archive/1/443500/100/100/threaded
http://www.securityfocus.com/archive/1/archive/1/447840/100/200/threaded
http://www.securityfocus.com/archive/1/archive/1/447837/100/200/threaded
Bugtraq: 20061017 Flaw in Firefox 2.0 RC2 (Google Search)
http://www.securityfocus.com/archive/1/archive/1/448956/100/100/threaded
Bugtraq: 20061019 Re: Flaw in Firefox 2.0 RC2 (Google Search)
http://www.securityfocus.com/archive/1/archive/1/448984/100/100/threaded
Bugtraq: 20061023 Flaw in Firefox 2.0 Final (Google Search)
http://www.securityfocus.com/archive/1/archive/1/449487/100/0/threaded
http://www.securityfocus.com/archive/1/archive/1/449245/100/100/threaded
Bugtraq: 20061025 Mozilla Firefox JavaScript Handler Race Condition Memory Corruption Vulnerability (Google Search)
http://www.securityfocus.com/archive/1/archive/1/449726/100/0/threaded
Bugtraq: 20060915 rPSA-2006-0169-1 firefox thunderbird (Google Search)
http://www.securityfocus.com/archive/1/archive/1/446140/100/0/threaded
http://lcamtuf.coredump.cx/ffoxdie.html
http://lcamtuf.coredump.cx/ffoxdie3.html
http://www.securiteam.com/securitynews/5VP0M0AJFW.html
http://www.pianetapc.it/view.php?id=770
http://security.gentoo.org/glsa/glsa-200609-19.xml
http://security.gentoo.org/glsa/glsa-200610-01.xml
http://security.gentoo.org/glsa/glsa-200610-04.xml
HPdes Security Advisory: HPSBUX02153
http://www1.itrc.hp.com/service/cki/docDisplay.do?docId=c00771742
HPdes Security Advisory: SSRT061181
http://www.mandriva.com/security/advisories?name=MDKSA-2006:168
http://www.mandriva.com/security/advisories?name=MDKSA-2006:169
http://www.redhat.com/support/errata/RHSA-2006-0676.html
http://www.redhat.com/support/errata/RHSA-2006-0677.html
http://www.redhat.com/support/errata/RHSA-2006-0675.html
SGI Security Advisory: 20060901-01-P
ftp://patches.sgi.com/support/free/security/advisories/20060901-01-P.asc
SuSE Security Announcement: SUSE-SA:2006:054 (Google Search)
http://www.novell.com/linux/security/advisories/2006_54_mozilla.html
http://www.ubuntu.com/usn/usn-350-1
http://www.ubuntu.com/usn/usn-351-1
http://www.ubuntu.com/usn/usn-352-1
http://www.ubuntu.com/usn/usn-354-1
BugTraq ID: 19534
http://www.securityfocus.com/bid/19534
BugTraq ID: 19488
http://www.securityfocus.com/bid/19488
http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:9528
http://www.vupen.com/english/advisories/2006/3617
http://www.vupen.com/english/advisories/2007/1198
http://www.vupen.com/english/advisories/2006/3748
http://www.vupen.com/english/advisories/2008/0083
http://securitytracker.com/id?1016846
http://securitytracker.com/id?1016847
http://securitytracker.com/id?1016848
http://secunia.com/advisories/21513
http://secunia.com/advisories/21906
http://secunia.com/advisories/21949
http://secunia.com/advisories/21915
http://secunia.com/advisories/21916
http://secunia.com/advisories/21939
http://secunia.com/advisories/21940
http://secunia.com/advisories/21950
http://secunia.com/advisories/22036
http://secunia.com/advisories/22001
http://secunia.com/advisories/22025
http://secunia.com/advisories/22055
http://secunia.com/advisories/22074
http://secunia.com/advisories/22088
http://secunia.com/advisories/22210
http://secunia.com/advisories/22274
http://secunia.com/advisories/22391
http://secunia.com/advisories/22422
http://secunia.com/advisories/22056
http://secunia.com/advisories/22195
http://secunia.com/advisories/24711
http://secunia.com/advisories/22066
Common Vulnerability Exposure (CVE) ID: CVE-2006-4340
http://www.imc.org/ietf-openpgp/mail-archive/msg14307.html
http://www.matasano.com/log/469/many-rsa-signatures-may-be-forgeable-in-openssl-and-elsewhere/
http://www.mozilla.org/security/announce/2006/mfsa2006-66.html
Debian Security Information: DSA-1191 (Google Search)
http://www.us.debian.org/security/2006/dsa-1191
Debian Security Information: DSA-1192 (Google Search)
http://www.debian.org/security/2006/dsa-1192
Debian Security Information: DSA-1210 (Google Search)
http://www.debian.org/security/2006/dsa-1210
http://www.gentoo.org/security/en/glsa/glsa-200610-06.xml
http://sunsolve.sun.com/search/document.do?assetkey=1-26-102648-1
http://sunsolve.sun.com/search/document.do?assetkey=1-26-102781-1
SuSE Security Announcement: SUSE-SA:2006:055 (Google Search)
http://www.novell.com/linux/security/advisories/2006_55_ssl.html
http://www.ubuntu.com/usn/usn-361-1
Cert/CC Advisory: TA06-312A
http://www.us-cert.gov/cas/techalerts/TA06-312A.html
http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:11007
http://www.vupen.com/english/advisories/2006/3622
http://www.vupen.com/english/advisories/2006/3899
http://www.vupen.com/english/advisories/2007/0293
http://securitytracker.com/id?1016858
http://securitytracker.com/id?1016859
http://securitytracker.com/id?1016860
http://secunia.com/advisories/21903
http://secunia.com/advisories/22226
http://secunia.com/advisories/22247
http://secunia.com/advisories/22299
http://secunia.com/advisories/22342
http://secunia.com/advisories/22446
http://secunia.com/advisories/22849
http://secunia.com/advisories/22992
http://secunia.com/advisories/23883
http://secunia.com/advisories/22044
XForce ISS Database: mozilla-nss-security-bypass(30098)
http://xforce.iss.net/xforce/xfdb/30098
Common Vulnerability Exposure (CVE) ID: CVE-2006-4565
BugTraq ID: 20042
http://www.securityfocus.com/bid/20042
http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:11421
XForce ISS Database: mozilla-javascript-expression-bo(28955)
http://xforce.iss.net/xforce/xfdb/28955
Common Vulnerability Exposure (CVE) ID: CVE-2006-4566
CERT/CC vulnerability note: VU#141528
http://www.kb.cert.org/vuls/id/141528
http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:9637
XForce ISS Database: mozilla-backslash-dos(28958)
http://xforce.iss.net/xforce/xfdb/28958
Common Vulnerability Exposure (CVE) ID: CVE-2006-4567
http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:10488
http://securitytracker.com/id?1016850
http://securitytracker.com/id?1016851
XForce ISS Database: mozilla-auto-update-gain-access(28950)
http://xforce.iss.net/xforce/xfdb/28950
Common Vulnerability Exposure (CVE) ID: CVE-2006-4570
http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:10892
http://securitytracker.com/id?1016866
http://securitytracker.com/id?1016867
XForce ISS Database: thunderbird-seamonkey-xbl-code-execution(28962)
http://xforce.iss.net/xforce/xfdb/28962
Common Vulnerability Exposure (CVE) ID: CVE-2006-4571
http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:11728
CopyrightCopyright (c) 2006 E-Soft Inc. http://www.securityspace.com

This is only one of 32582 vulnerability tests in our test suite. Find out more about running a complete security audit.

To run a free test of this vulnerability against your system, register below.

New User Registration
Email:
UserID:
Passwd:
Please email me your monthly newsletters, informing the latest services, improvements & surveys.
Please email me a vulnerability test announcement whenever a new test is added.
   Privacy
Registered User Login
 
UserID:   
Passwd:  

 Forgot userid or passwd?
Email/Userid:




Home | About Us | Contact Us | Partner Programs | Privacy | Mailing Lists | Abuse
Security Audits | Managed DNS | Network Monitoring | Site Analyzer | Internet Research Reports
Web Probe | Whois

© 1998-2014 E-Soft Inc. All rights reserved.