-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

===========================================================================
                         AUSCERT Security Bulletin

                               ASB-2009.1073
                         SeaMonkey 1.1.18 Released
                             4 September 2009

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:              SeaMonkey
Operating System:     UNIX variants (UNIX, Linux, OSX)
                      Windows
Impact/Access:        Provide Misleading Information  -- Remote/Unauthenticated
                      Execute Arbitrary Code/Commands -- Remote/Unauthenticated
Resolution:           Patch/Upgrade
CVE Names:            CVE-2009-2408 CVE-2009-2404 
Member content until: Sunday, October  4 2009
Reference:            ASB-2009.1059
                      ASB-2009.1040

OVERVIEW

        Mozilla have released SeaMonkey version 1.1.18, correcting two
        critical security vulnerabilities.


IMPACT

        According to Mozilla, the vulnerabilties corrected in this update 
        are:
        
          o MFSA 2009-42 (CVE-2009-2408): "IOActive security researcher Dan 
            Kaminsky reported a mismatch in the treatment of domain names in 
            SSL certificates between SSL clients and the Certificate 
            Authorities (CA) which issue server certificates. In particular, 
            if a malicious person requested a certificate for a host name 
            with an invalid null character in it most CAs would issue the 
            certificate if the requester owned the domain specified after 
            the null, while most SSL clients (browsers) ignored that part of 
            the name and used the unvalidated part in front of the null. 
            This made it possible for attackers to obtain certificates that 
            would function for any site they wished to target. These 
            certificates could be used to intercept and potentially alter 
            encrypted communication between the client and a server such as 
            sensitive bank account transactions." [1]
        
          o MFSA 2009-43 (CVE-2009-2404): "Moxie Marlinspike reported a 
            heap overflow vulnerability in the code that handles regular 
            expressions in certificate names. This vulnerability could be 
            used to compromise the browser and run arbitrary code by 
            presenting a specially crafted certificate to the client." [2]


MITIGATION

        Users can download SeaMonkey 1.1.18 from the vendor's website. [3]


REFERENCES

        [1] Mozilla Foundation Security Advisory 2009-42
            http://www.mozilla.org/security/announce/2009/mfsa2009-42.html

        [2] Mozilla Foundation Security Advisory 2009-43
            http://www.mozilla.org/security/announce/2009/mfsa2009-43.html

        [3] SeaMonkey Download & Releases
            http://www.seamonkey-project.org/releases/#1.1.18

AusCERT has made every effort to ensure that the information contained
in this document is accurate.  However, the decision to use the information
described is the responsibility of each user or organisation. The decision to
follow or act on information or advice contained in this security bulletin is
the responsibility of each user or organisation, and should be considered in
accordance with your organisation's site policies and procedures. AusCERT
takes no responsibility for consequences which may arise from following or
acting on information or advice contained in this security bulletin.

If you believe that your computer system has been compromised or attacked in 
any way, we encourage you to let us know by completing the secure National IT 
Incident Reporting Form at:

        http://www.auscert.org.au/render.html?it=3192

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours 
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iD8DBQFKoKHaNVH5XJJInbgRApvOAJ9BBh+U9nNIwMusMgBmfxFUgnFO+ACfTfP9
B+XaNoVRvcS2bdMk86DsqII=
=94Oa
-----END PGP SIGNATURE-----