-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

===========================================================================
                         AUSCERT Security Bulletin

                               ASB-2009.1059
                       Thunderbird 2.0.0.23 Released
                              24 August 2009

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:              Thunderbird
Operating System:     Windows
                      UNIX variants (UNIX, Linux, OSX)
Impact/Access:        Access Privileged Data         -- Remote/Unauthenticated
                      Provide Misleading Information -- Remote/Unauthenticated
Resolution:           Patch/Upgrade
CVE Names:            CVE-2009-2408  
Member content until: Wednesday, September 23 2009
Reference:            ASB-2009.1040
                      ESB-2009.1121

Comment: This same vulnerability also affected Firefox but was previously
         corrected in versions 3.5 and 3.0.13. Newer versions of 3.5 have
         since been released. It is also reportedly corrected in SeaMonkey
         version 1.1.18 which had not been released at the time of this
         publication.

OVERVIEW

        Mozilla have released a new version of Thunderbrid, correcting one
        critical security vulnerability.


IMPACT

        The following vulnerabilty has been corrected in Thunderbird 
        2.0.0.23:
        
        o MFSA 2009-42 (CVE-2009-2408): "IOActive security researcher Dan 
          Kaminsky reported a mismatch in the treatment of domain names in 
          SSL certificates between SSL clients and the Certificate 
          Authorities (CA) which issue server certificates. In particular, 
          if a malicious person requested a certificate for a host name with 
          an invalid null character in it most CAs would issue the 
          certificate if the requester owned the domain specified after the 
          null, while most SSL clients (browsers) ignored that part of the 
          name and used the unvalidated part in front of the null. This made 
          it possible for attackers to obtain certificates that would 
          function for any site they wished to target. These certificates 
          could be used to intercept and potentially alter encrypted 
          communication between the client and a server such as sensitive 
          bank account transactions." [1]


MITIGATION

        Thunderbird version 2.0.0.23 is available for download from the
        vendor's website. [2]


REFERENCES

        [1] Mozilla Foundation Security Advisory 2009-42
            http://www.mozilla.org/security/announce/2009/mfsa2009-42.html

        [2] Thunderbird 2
            http://www.mozillamessaging.com/en-US/thunderbird/

AusCERT has made every effort to ensure that the information contained
in this document is accurate.  However, the decision to use the information
described is the responsibility of each user or organisation. The decision to
follow or act on information or advice contained in this security bulletin is
the responsibility of each user or organisation, and should be considered in
accordance with your organisation's site policies and procedures. AusCERT
takes no responsibility for consequences which may arise from following or
acting on information or advice contained in this security bulletin.

If you believe that your computer system has been compromised or attacked in 
any way, we encourage you to let us know by completing the secure National IT 
Incident Reporting Form at:

        http://www.auscert.org.au/render.html?it=3192

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours 
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iD8DBQFKkg6vNVH5XJJInbgRAvajAJ9CPDYJMxfAad8HXOKrluKgYG2kUwCfT5qq
LH7hDFsTRdFxeJmy8D5Nrxw=
=YDjI
-----END PGP SIGNATURE-----