Remote execution flaw mars older Thunderbird versions
Mozilla's email add-on blues
Posted in Security, 11th December 2009 19:22 GMT
Free whitepaper – Driving Situational Awareness:
Developers of the Thunderbird email client are in the process of patching a vulnerability that could allow attackers to remotely execute malicious code on end users' machines, security researchers said.
The flaw resides in the dtoa implementation of version 2.0.0.23 of Thunderbird, according to an advisory issued Friday by SecurityReason. The vulnerability mostly affects programs that are running various add-ons, including Lightning 0.9 and Thunderbrowse 3.2.6.7.
"We can create any number of float, which will overwrite the memory," the advisory states. "In Kmax has defined 15. Functions in dtoa, don't checks Kmax limit, and it is possible to call 16<= elements of freelist array."
A spokesman for Mozilla Messaging, the outfit that develops Thunderbird, said clients that don't run add-ons aren't vulnerable.
The bug has been fixed in the recently released version 3 of the email client and will also be patched in the upcoming version 2.0.0.24. The spokesman said it was unclear when it would be released and advised users to install Thunderbird 3.
It's been three days since the official release of that updated program, and there are relatively few reports of problems in the official support forum for the app. Now may be the time to upgrade. ®
The Register Webcast - Desktop Support : The Hub of IT
The Register Guide to managing spam
The Register Green Computing Report
Secure Mobile Working
Risk and Resilience
