PT-2006-1930 · Mozilla+2 · Thunderbird+2

Georgi Guninski · Publicado 2006-02-24 · Atualizado 2018-10-18 · CVE-2006-0884

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Mozilla Thunderbird versions 1.0.7 and earlier

Description The issue allows attackers to bypass javascript security settings and obtain sensitive information or cause a crash. This is achieved through an e-mail containing a javascript URI in the SRC attribute of an IFRAME tag, which is executed when the user edits the e-mail.

Recommendations For Mozilla Thunderbird versions 1.0.7 and earlier, consider disabling the WYSIWYG rendering engine or restricting the use of javascript in e-mails to minimize the risk of exploitation.

Exploit

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2006-0884

DSA-1046-1

DSA-1051-1

HPSBUX02122

RHSA-2006:0329

RHSA-2006:0330

RHSA-2006_0329

RHSA-2006_0330

Produtos afetados

Hp-Ux

Thunderbird

Red Hat

Referências · 99

• 🔥 http://securityfocus.com/bid/16770 · Exploit
• 🔥 http://securitytracker.com/id?1015665 · Exploit
• 🔥 https://exploit-db.com/exploits/27257 · Exploit
• http://mozilla.org/security/announce/2006/mfsa2006-21.html · Aviso do Fabricante
• https://access.redhat.com/security/cve/CVE-2006-1727 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1736 · Nota de Segurança
• http://securityfocus.com/archive/1/446657/100/200/threaded · Aviso do Fabricante
• http://mandriva.com/security/advisories?name=MDKSA-2006:078 · Aviso do Fabricante
• http://redhat.com/support/errata/RHSA-2006-0329.html · Aviso do Fabricante
• https://access.redhat.com/security/cve/CVE-2006-1742 · Nota
• http://secunia.com/advisories/19823 · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1733 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0748 · Nota de Segurança
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A2024 · Nota
• http://osvdb.org/23653 · Nota