-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

===========================================================================
AA-2006.0003                  AUSCERT Advisory

                             [Win][UNIX/Linux]
Thunderbird 1.5 release fixes email attachment type spoofing vulnerability
                              23 January 2006
- ---------------------------------------------------------------------------

        AusCERT Advisory Summary
        ------------------------

Product:           Mozilla Thunderbird 1.0.7 and prior
Operating System:  Windows
                   UNIX variants (UNIX, Linux, OSX)
Impact:            Provide Misleading Information
Access:            Remote/Unauthenticated
CVE Names:         CVE-2006-0236
Member-only until: Monday, February 20 2006


OVERVIEW:

	The Thunderbird email client versions 1.0.7 and prior allows an 
	attacker to spoof the file extension and associated file type icon for 
	email attachments. [1]

	This can be exploited by using long attachment filenames containing 
	whitespace, in conjunction with false Content-Type headers.


IMPACT:

	A remote attacker can potentially trick a user into running an 
	malicious executable attachment, by making it appear to be a harmless
	text or image file.


MITIGATION:

	Thunderbird 1.5 has been released fixing this vulnerability. [2]


REFERENCES:

	[1] Secunia Research Advisory
	    http://secunia.com/secunia_research/2005-22/advisory/

	[2] Thunderbird 1.5 release notes
	    http://www.mozilla.com/thunderbird/releases/1.5.html


AusCERT has made every effort to ensure that the information contained
in this document is accurate.  However, the decision to use the information
described is the responsibility of each user or organisation. The decision to
follow or act on information or advice contained in this security bulletin is
the responsibility of each user or organisation, and should be considered in
accordance with your organisation's site policies and procedures. AusCERT
takes no responsibility for consequences which may arise from following or
acting on information or advice contained in this security bulletin.

If you believe that your computer system has been compromised or attacked in 
any way, we encourage you to let us know by completing the secure National IT 
Incident Reporting Form at:

        http://www.auscert.org.au/render.html?it=3192

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================

-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQCVAwUBQ9Rl7yh9+71yA2DNAQJIpQP+Je0J3I3bbbTk1QuVQWCvMDtAOfkXeDWN
A5p9DooE1pUdJeL4Di8uxb6xt4Olxca7NDXvLzITOx3n7uGRvx0UuzP+5Y1En7rD
/anK0rJfvD4j9QXtG3PuyMxXQ1KQrQ+KSAFgcevWieDX34kydyXufXDa9/qLWhx1
EmPv/Xyp4yk=
=JJ/I
-----END PGP SIGNATURE-----