PT-2005-4200 · Mozilla · Thunderbird

Thomas Henlich · Published 2005-11-01 · Updated 2016-10-18 · CVE-2005-3402

Positive Technologies (AI Summary)

CVSS v2.0

2.6

Low

Base vector

AV:N/AC:H/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Mozilla Thunderbird versions 1.0.5 BETA through 1.0.7

Description The issue allows remote attackers to obtain authentication information without detection via a man-in-the-middle (MITM) attack. This attack bypasses TLS authentication or downgrades CRAM-MD5 authentication to plain authentication, potentially exposing user credentials.

Recommendations For Mozilla Thunderbird versions 1.0.5 BETA through 1.0.7, consider disabling the SMTP client functionality until a patch is available to prevent potential man-in-the-middle attacks. Restrict access to sensitive information and authentication processes to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2005-3402

Affected Products

Thunderbird

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2005-3402 · Security Note
• http://marc.info/?l=bugtraq&m=113034421329653&w=2 · Note
• http://marc.info/?l=bugtraq&m=113028017608146&w=2 · Note
• http://securityfocus.com/bid/15106 · Note
• https://bugzilla.mozilla.org/show_bug.cgi?id=311657 · Note