==========================================================================
Ubuntu Security Notice USN-1122-2
May 05, 2011
thunderbird vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 11.04
Summary:
Thunderbird could be made to run programs as your login if it opened
specially crafted mail.
Software Description:
- thunderbird: mail/news client with RSS and integrated spam filter support
Details:
USN-1122-1 fixed vulnerabilities in Thunderbird for Lucid and Maverick.
This update provides the corresponding fixes for Natty.
Original advisory details:
It was discovered that there was a vulnerability in the memory handling of
certain types of content. An attacker could exploit this to possibly run
arbitrary code as the user running Thunderbird. (CVE-2011-0081)
It was discovered that Thunderbird incorrectly handled certain JavaScript
requests. If JavaScript were enabled, an attacker could exploit this to
possibly run arbitrary code as the user running Thunderbird.
(CVE-2011-0069)
Ian Beer discovered a vulnerability in the memory handling of a certain
types of documents. An attacker could exploit this to possibly run
arbitrary code as the user running Thunderbird. (CVE-2011-0070)
Bob Clary, Henri Sivonen, Marco Bonardo, Mats Palmgren and Jesse Ruderman
discovered several memory vulnerabilities. An attacker could exploit these
to possibly run arbitrary code as the user running Thunderbird.
(CVE-2011-0080)
Aki Helin discovered multiple vulnerabilities in the HTML rendering code.
An attacker could exploit these to possibly run arbitrary code as the user
running Thunderbird. (CVE-2011-0074, CVE-2011-0075)
Ian Beer discovered multiple overflow vulnerabilities. An attacker could
exploit these to possibly run arbitrary code as the user running
Thunderbird. (CVE-2011-0077, CVE-2011-0078)
Martin Barbella discovered a memory vulnerability in the handling of
certain DOM elements. An attacker could exploit this to possibly run
arbitrary code as the user running Thunderbird. (CVE-2011-0072)
It was discovered that there were use-after-free vulnerabilities in
Thunderbird's mChannel and mObserverList objects. An attacker could exploit
these to possibly run arbitrary code as the user running Thunderbird.
(CVE-2011-0065, CVE-2011-0066)
It was discovered that there was a vulnerability in the handling of the
nsTreeSelection element. An attacker sending a specially crafted E-Mail
could exploit this to possibly run arbitrary code as the user running
Thunderbird. (CVE-2011-0073)
Paul Stone discovered a vulnerability in the handling of Java applets. If
plugins were enabled, an attacker could use this to mimic interaction with
form autocomplete controls and steal entries from the form history.
(CVE-2011-0067)
Soroush Dalili discovered a vulnerability in the resource: protocol. This
could potentially allow an attacker to load arbitrary files that were
accessible to the user running Thunderbird. (CVE-2011-0071)
Chris Evans discovered a vulnerability in Thunderbird's XSLT generate-id()
function. An attacker could possibly use this vulnerability to make other
attacks more reliable. (CVE-2011-1202)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 11.04:
thunderbird 3.1.10+build1+nobinonly-0ubuntu0.11.04.1
After a standard system update you need to restart Thunderbird to make
all the necessary changes.
References:
CVE-2011-0065, CVE-2011-0066, CVE-2011-0067, CVE-2011-0069,
CVE-2011-0070, CVE-2011-0071, CVE-2011-0072, CVE-2011-0073,
CVE-2011-0074, CVE-2011-0075, CVE-2011-0077, CVE-2011-0078,
CVE-2011-0080, CVE-2011-0081, CVE-2011-1202
Package Information:
https://launchpad.net/ubuntu/+source/thunderbird/3.1.10+build1+nobinonly-0ubuntu0.11.04.1
--------------enig3003645AF7A0EA9437306F36
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename="signature.asc"
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
iEYEARECAAYFAk3CZ78ACgkQTniv4aqX/VkZkQCePuwnymQCmr3qll05S6Ky3EvO
8OcAn0LygsmybsZIpXYre+yzdrKbYbXP
=qQc3
-----END PGP SIGNATURE-----
--------------enig3003645AF7A0EA9437306F36--
From - Thu May 5 17:43:01 2011
X-Account-Key: account7
X-UIDL: 4d7faa1e00015935
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
X-Mozilla-Keys:
Return-Path: <bugtraq-return-46823-lists=securityspace.com@securityfocus.com>
X-Original-To: lists@securityspace.com
Delivered-To: lists@securityspace.com
Received: from outgoing2.securityfocus.com (outgoing.securityfocus.com [205.206.231.26])
by mx.securityspace.com (Postfix) with ESMTP id 935BAEC143
for <lists@securityspace.com>; Thu, 5 May 2011 15:26:04 -0400 (EDT)
Received: from lists2.securityfocus.com (lists2.securityfocus.com [205.206.231.20])
by outgoing2.securityfocus.com (Postfix) with QMQP
id 6910D143805; Thu, 5 May 2011 12:21:33 -0600 (MDT)
Mailing-List: contact bugtraq-help@securityfocus.com; run by ezmlm
Precedence: bulk
List-Id: <bugtraq.list-id.securityfocus.com>
List-Post: <mailto:bugtraq@securityfocus.com>
List-Help: <mailto:bugtraq-help@securityfocus.com>
List-Unsubscribe: <mailto:bugtraq-unsubscribe@securityfocus.com>
List-Subscribe: <mailto:bugtraq-subscribe@securityfocus.com>
Delivered-To: mailing list bugtraq@securityfocus.com
Delivered-To: moderator for bugtraq@securityfocus.com
Received: (qmail 32249 invoked from network); 5 May 2011 16:35:18 -0000
Message-ID: <4DC2D18D.9000803@procheckup.com>
Date: Thu, 5 May 2011 17:34:21 +0100
From: research <research@procheckup.com>
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.0; en-GB; rv:1.9.2.15) Gecko/20110303 Thunderbird/3.1.9
MIME-Version: 1.0
To: <vuln@secunia.com>, <full-disclosure@lists.grok.org.uk>,
<bugtraq@securityfocus.com>, <news@securiteam.com>
Subject: PR10-13: Multiple XSS and Authentication flaws within BMC Remedy
Knowledge Management
X-Enigmail-Version: 1.1.1
Content-Type: text/plain; charset="ISO-8859-1"
Content-Transfer-Encoding: 7bit
X-Brightmail-Tracker: AAAAAQAAAWEStatus: RO
PR10-13: Multiple XSS and Authentication flaws within BMC Remedy
Knowledge Management
Vulnerability found: 17th July 2010
Vendor informed:
Vulnerability fixed:
Severity: High
Description:
BMC Remedy Knowledge Management provides service desk analysts with a
knowledge base of easy-to-find solutions and gives users self-service
search options to help them resolve issues on their own. ProCheckUp has
discovered that multiple Remedy Knowledge Management pages are
vulnerable to reflective XSS attacks, a built in self help account
allows for authentication bypass.
Version: 7.5.00 -
http://www.bmc.com/
1) The following demonstrate the reflective XSS flaws
https://target-domain.foo/rkm/external.jsp?doc='%3balert(1)//&user=Self+Help
https://target-domain.foo/rkm/search.jsp?user=Self+Help&startDate=\'%3balert(1)//
https://target-domain.foo/rkm/usersettings.jsp?"><script>alert(1)</script>
https://target-domain.foo/rkm/viewdoc.jsp?doc=><script>alert(1)</script>&user=Self%20Help
Works on IE - login screen referrer XSS
https://target-domain.foo/rkm/AttachmentServlet?="><script>alert(1)</script>
Consequences:
An attacker may be able to cause execution of malicious scripting code
in the browser of a user who clicks on a link to Remedy Knowledge
Management based site. Such code would run within the security context
of the target domain. This type of attack can result in non-persistent
defacement of the target site, or the redirection of confidential
information (i.e.: session IDs) to unauthorised third parties.
2) Remedy Knowledge Management is vulnerable to authentication bypass
by using a built in default account. (user=Self%20Help)
https://target-domain.foo/rkm/index.jsp?user=Self%20Help
The following directory requires a password to authenticate only
https://target-domain.foo/rkm/configuration
Consequences:
An attacker may be able to gain access to data held within a Remedy
Knowledge Managment based site.
Fix:
.
References:
http://www.procheckup.com/Vulnerabilities.php
Credits: Richard Brain of ProCheckUp Ltd (www.procheckup.com)
Legal:
Copyright 2010 Procheckup Ltd. All rights reserved.
Permission is granted for copying and circulating this Bulletin to the
Internet community for the purpose of alerting them to problems, if and
only if, the Bulletin is not edited or changed in any way, is attributed
to Procheckup, and provided such reproduction and/or distribution is
performed for non-commercial purposes.
Any other use of this information is prohibited. Procheckup is not
liable for any misuse of this information by any third party.
From - Fri May 6 10:33:48 2011
X-Account-Key: account7
X-UIDL: 4d7faa1e00015966
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
X-Mozilla-Keys:
Return-Path: <bugtraq-return-46824-lists=securityspace.com@securityfocus.com>
X-Original-To: lists@securityspace.com
Delivered-To: lists@securityspace.com
Received: from outgoing3.securityfocus.com (outgoing.securityfocus.com [205.206.231.27])
by mx.securityspace.com (Postfix) with ESMTP id 2CCFAEC12A
for <lists@securityspace.com>; Fri, 6 May 2011 10:29:27 -0400 (EDT)
Received: from lists2.securityfocus.com (lists2.securityfocus.com [205.206.231.20])
by outgoing3.securityfocus.com (Postfix) with QMQP
id 265E7236F7D; Fri, 6 May 2011 08:25:43 -0600 (MDT)
Mailing-List: contact bugtraq-help@securityfocus.com; run by ezmlm
Precedence: bulk
List-Id: <bugtraq.list-id.securityfocus.com>
List-Post: <mailto:bugtraq@securityfocus.com>
List-Help: <mailto:bugtraq-help@securityfocus.com>
List-Unsubscribe: <mailto:bugtraq-unsubscribe@securityfocus.com>
List-Subscribe: <mailto:bugtraq-subscribe@securityfocus.com>
Delivered-To: mailing list bugtraq@securityfocus.com
Delivered-To: moderator for bugtraq@securityfocus.com
Received: (qmail 17437 invoked from network); 5 May 2011 21:17:30 -0000
Date: Thu, 5 May 2011 14:17:21 -0700
From: Kees Cook <kees@ubuntu.com>
To: ubuntu-security-announce@lists.ubuntu.com
Cc: bugtraq@securityfocus.com, full-disclosure@lists.grok.org.uk
Subject: [USN-1111-1] Linux kernel vulnerabilities
Message-ID: <20110505211721.GH28888@outflux.net>
Reply-To: Ubuntu Security <security@ubuntu.com>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha512;
protocol="application/pgp-signature"; boundary="IS0zKkzwUGydFO0o"
Content-Disposition: inline
Organization: Ubuntu
X-MIMEDefang-Filter: outflux$Revision: 1.316 $
X-HELO: www.outflux.net
X-Scanned-By: MIMEDefang 2.69 on 10.2.0.1
Status:
--IS0zKkzwUGydFO0o
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
=========================================================================Ubuntu Security Notice USN-1111-1
May 05, 2011
linux-source-2.6.15 vulnerabilities
=========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 6.06 LTS
Summary:
Multiple flaws fixed in the Linux kernel.
Software Description:
- linux-source-2.6.15: Linux kernel
Details:
Dan Rosenberg discovered multiple flaws in the X.25 facilities parsing. If
a system was using X.25, a remote attacker could exploit this to crash the
system, leading to a denial of service. (CVE-2010-4164)
Vegard Nossum discovered that memory garbage collection was not handled
correctly for active sockets. A local attacker could exploit this to
allocate all available kernel memory, leading to a denial of service.
(CVE-2010-4249)
Nelson Elhage discovered that the kernel did not correctly handle process
cleanup after triggering a recoverable kernel bug. If a local attacker were
able to trigger certain kinds of kernel bugs, they could create a specially
crafted process to gain root privileges. (CVE-2010-4258)
Nelson Elhage discovered that Econet did not correctly handle AUN packets
over UDP. A local attacker could send specially crafted traffic to crash
the system, leading to a denial of service. (CVE-2010-4342)
Dan Rosenberg discovered that the OSS subsystem did not handle name
termination correctly. A local attacker could exploit this crash the system
or gain root privileges. (CVE-2010-4527)
Dan Rosenberg discovered that IRDA did not correctly check the size of
buffers. On non-x86 systems, a local attacker could exploit this to read
kernel heap memory, leading to a loss of privacy. (CVE-2010-4529)
Dan Carpenter discovered that the TTPCI DVB driver did not check certain
values during an ioctl. If the dvb-ttpci module was loaded, a local
attacker could exploit this to crash the system, leading to a denial of
service, or possibly gain root privileges. (CVE-2011-0521)
Jens Kuehnel discovered that the InfiniBand driver contained a race
condition. On systems using InfiniBand, a local attacker could send
specially crafted requests to crash the system, leading to a denial of
service. (CVE-2011-0695)
Timo Warns discovered that the LDM disk partition handling code did not
correctly handle certain values. By inserting a specially crafted disk
device, a local attacker could exploit this to gain root privileges.
(CVE-2011-1017)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 6.06 LTS:
linux-image-2.6.15-57-386 2.6.15-57.97
linux-image-2.6.15-57-686 2.6.15-57.97
linux-image-2.6.15-57-amd64-generic 2.6.15-57.97
linux-image-2.6.15-57-amd64-k8 2.6.15-57.97
linux-image-2.6.15-57-amd64-server 2.6.15-57.97
linux-image-2.6.15-57-amd64-xeon 2.6.15-57.97
linux-image-2.6.15-57-hppa32 2.6.15-57.97
linux-image-2.6.15-57-hppa32-smp 2.6.15-57.97
linux-image-2.6.15-57-hppa64 2.6.15-57.97
linux-image-2.6.15-57-hppa64-smp 2.6.15-57.97
linux-image-2.6.15-57-itanium 2.6.15-57.97
linux-image-2.6.15-57-itanium-smp 2.6.15-57.97
linux-image-2.6.15-57-k7 2.6.15-57.97
linux-image-2.6.15-57-mckinley 2.6.15-57.97
linux-image-2.6.15-57-mckinley-smp 2.6.15-57.97
linux-image-2.6.15-57-powerpc 2.6.15-57.97
linux-image-2.6.15-57-powerpc-smp 2.6.15-57.97
linux-image-2.6.15-57-powerpc64-smp 2.6.15-57.97
linux-image-2.6.15-57-server 2.6.15-57.97
linux-image-2.6.15-57-server-bigiron 2.6.15-57.97
linux-image-2.6.15-57-sparc64 2.6.15-57.97
linux-image-2.6.15-57-sparc64-smp 2.6.15-57.97
After a standard system update you need to reboot your computer to make
all the necessary changes.
References:
CVE-2010-4164, CVE-2010-4249, CVE-2010-4258, CVE-2010-4342,
CVE-2010-4527, CVE-2010-4529, CVE-2011-0521, CVE-2011-0695,
CVE-2011-1017
Package Information:
https://launchpad.net/ubuntu/+source/linux-source-2.6.15/2.6.15-57.97
--IS0zKkzwUGydFO0o
