Mozilla Thunderbird was updated to version 2.0.0.23.

The release fixes one security issue: MFSA 2009-42 / CVE-2009-2408:
IOActive security researcher Dan Kaminsky reported a mismatch in the treatment of domain names in SSL certificates between SSL clients and the Certificate Authorities (CA) which issue server certificates. In particular, if a malicious person requested a certificate for a host name with an invalid null character in it most CAs would issue the certificate if the requester owned the domain specified after the null, while most SSL clients (browsers) ignored that part of the name and used the unvalidated part in front of the null. This made it possible for attackers to obtain certificates that would function for any site they wished to target. These certificates could be used to intercept and potentially alter encrypted communication between the client and a server such as sensitive bank account transactions. This vulnerability was independently reported to us by researcher Moxie Marlinspike who also noted that since Firefox relies on SSL to protect the integrity of security updates this attack could be used to serve malicious updates.

This update of mutt improves the handling of the \0 character in SSL certificates. (CVE-2009-2408 )

The Mozilla NSS security framework was updated to version 3.12.3.1.

  - Heap-based buffer overflow in a regular-expression     parser in Mozilla Network Security Services (NSS) before     3.12.3, as used in Firefox, Thunderbird, SeaMonkey,     Evolution, Pidgin, and AOL Instant Messenger (AIM),     allows remote SSL servers to cause a denial of service     (application crash) or possibly execute arbitrary code     via a long domain name in the subject's Common Name (CN)     field of an X.509 certificate, related to the     cert_TestHostName function. (CVE-2009-2404 / MFSA     2009-43)

  - IOActive security researcher Dan Kaminsky reported a     mismatch in the treatment of domain names in SSL     certificates between SSL clients and the Certificate     Authorities (CA) which issue server certificates. In     particular, if a malicious person requested a     certificate for a host name with an invalid null     character in it most CAs would issue the certificate if     the requester owned the domain specified after the null,     while most SSL clients (browsers) ignored that part of     the name and used the unvalidated part in front of the     null. This made it possible for attackers to obtain     certificates that would function for any site they     wished to target. These certificates could be used to     intercept and potentially alter encrypted communication     between the client and a server such as sensitive bank     account transactions. This vulnerability was     independently reported to us by researcher Moxie     Marlinspike who also noted that since Firefox relies on     SSL to protect the integrity of security updates this     attack could be used to serve malicious updates. (MFSA     2009-42 / CVE-2009-2408)

The Mozilla NSS and dependend libraries were updated to fix various issues.

CVE-2009-2404 / MFSA 2009-43 : Heap-based buffer overflow in a regular-expression parser in Mozilla Network Security Services (NSS) before 3.12.3, as used in Firefox, Thunderbird, SeaMonkey, Evolution, Pidgin, and AOL Instant Messenger (AIM), allows remote SSL servers to cause a denial of service (application crash) or possibly execute arbitrary code via a long domain name in the subject's Common Name (CN) field of an X.509 certificate, related to the cert_TestHostName function.

MFSA 2009-42 / CVE-2009-2408: IOActive security researcher Dan Kaminsky reported a mismatch in the treatment of domain names in SSL certificates between SSL clients and the Certificate Authorities (CA) which issue server certificates. In particular, if a malicious person requested a certificate for a host name with an invalid null character in it most CAs would issue the certificate if the requester owned the domain specified after the null, while most SSL clients (browsers) ignored that part of the name and used the unvalidated part in front of the null. This made it possible for attackers to obtain certificates that would function for any site they wished to target.
These certificates could be used to intercept and potentially alter encrypted communication between the client and a server such as sensitive bank account transactions. This vulnerability was independently reported to us by researcher Moxie Marlinspike who also noted that since Firefox relies on SSL to protect the integrity of security updates this attack could be used to serve malicious updates.

seamonkey was updated to version 1.1.18, fixing various security issues :

MFSA 2009-43 / CVE-2009-2404 Moxie Marlinspike reported a heap overflow vulnerability in the code that handles regular expressions in certificate names. This vulnerability could be used to compromise the browser and run arbitrary code by presenting a specially crafted certificate to the client. This code provided compatibility with the non-standard regular expression syntax historically supported by Netscape clients and servers. With version 3.5 Firefox switched to the more limited industry-standard wildcard syntax instead and is not vulnerable to this flaw. 

MFSA 2009-42 / CVE-2009-2408: IOActive security researcher Dan Kaminsky reported a mismatch in the treatment of domain names in SSL certificates between SSL clients and the Certificate Authorities (CA) which issue server certificates. In particular, if a malicious person requested a certificate for a host name with an invalid null character in it most CAs would issue the certificate if the requester owned the domain specified after the null, while most SSL clients (browsers) ignored that part of the name and used the unvalidated part in front of the null. This made it possible for attackers to obtain certificates that would function for any site they wished to target.
These certificates could be used to intercept and potentially alter encrypted communication between the client and a server such as sensitive bank account transactions. This vulnerability was independently reported to us by researcher Moxie Marlinspike who also noted that since Firefox relies on SSL to protect the integrity of security updates this attack could be used to serve malicious updates.
Mozilla would like to thank Dan and the Microsoft Vulnerability Research team for coordinating a multiple-vendor response to this problem.

The update also contains the fixes from the skipped 1.1.17 security update: MFSA 2009-17/CVE-2009-1307: Same-origin violations when Adobe Flash loaded via view-source: scheme 

MFSA 2009-21/CVE-2009-1311:POST data sent to wrong site when saving web page with embedded frame 

MFSA 2009-24/CVE-2009-1392/CVE-2009-1832/CVE-2009-1833: Crashes with evidence of memory corruption (rv:1.9.0.11) 

MFSA 2009-26/CVE-2009-1835: Arbitrary domain cookie access by local file: resources 

MFSA 2009-27/CVE-2009-1836: SSL tampering via non-200 responses to proxy CONNECT requests 

MFSA 2009-29/CVE-2009-1838: Arbitrary code execution using event listeners attached to an element whose owner document is null 

MFSA 2009-32/CVE-2009-1841: JavaScript chrome privilege escalation MFSA 2009-33/CVE-2009-2210: Crash viewing multipart/alternative message with text/enhanced part

neon did not properly handle embedded NUL characters in X.509 certificates when comparing host names. Attackers could exploit that to spoof SSL servers (CVE-2009-2408).

Specially crafted XML documents that contain a large number of nested entity references could cause neon to consume large amounts of CPU and memory (CVE-2009-2473).

CVE-2009-2409 deprecate MD2 in SSL cert validation (Kaminsky)

CVE-2009-2408 firefox/nss: doesn't handle NULL in Common Name properly

CVE-2009-2654 firefox: URL bar spoofing vulnerability

CVE-2009-3072 Firefox 3.5.3 3.0.14 browser engine crashes

CVE-2009-3075 Firefox 3.5.2 3.0.14 JavaScript engine crashes

CVE-2009-3076 Firefox 3.0.14 Insufficient warning for PKCS11 module installation and removal

CVE-2009-3077 Firefox 3.5.3 3.0.14 TreeColumns dangling pointer vulnerability

Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause SeaMonkey to crash or, potentially, execute arbitrary code with the privileges of the user running SeaMonkey. (CVE-2009-3072, CVE-2009-3075)

A use-after-free flaw was found in SeaMonkey. An attacker could use this flaw to crash SeaMonkey or, potentially, execute arbitrary code with the privileges of the user running SeaMonkey. (CVE-2009-3077)

Dan Kaminsky discovered flaws in the way browsers such as SeaMonkey handle NULL characters in a certificate. If an attacker is able to get a carefully-crafted certificate signed by a Certificate Authority trusted by SeaMonkey, the attacker could use the certificate during a man-in-the-middle attack and potentially confuse SeaMonkey into accepting it by mistake. (CVE-2009-2408)

Descriptions in the dialogs when adding and removing PKCS #11 modules were not informative. An attacker able to trick a user into installing a malicious PKCS #11 module could use this flaw to install their own Certificate Authority certificates on a user's machine, making it possible to trick the user into believing they are viewing a trusted site or, potentially, execute arbitrary code with the privileges of the user running SeaMonkey. (CVE-2009-3076)

A flaw was found in the way SeaMonkey displays the address bar when window.open() is called in a certain way. An attacker could use this flaw to conceal a malicious URL, possibly tricking a user into believing they are viewing a trusted site. (CVE-2009-2654)

Dan Kaminsky found that browsers still accept certificates with MD2 hash signatures, even though MD2 is no longer considered a cryptographically strong algorithm. This could make it easier for an attacker to create a malicious certificate that would be treated as trusted by a browser. NSS (provided by SeaMonkey) now disables the use of MD2 and MD4 algorithms inside signatures by default.
(CVE-2009-2409)

After installing the update, SeaMonkey must be restarted for the changes to take effect.

Updated nspr and nss packages that fix security issues are now available for Red Hat Enterprise Linux 5.2 Extended Update Support.

This update has been rated as having critical security impact by the Red Hat Security Response Team.

Netscape Portable Runtime (NSPR) provides platform independence for non-GUI operating system facilities. These facilities include threads, thread synchronization, normal file and network I/O, interval timing, calendar time, basic memory management (malloc and free), and shared library linking.

Network Security Services (NSS) is a set of libraries designed to support the cross-platform development of security-enabled client and server applications. Applications built with NSS can support SSLv2, SSLv3, TLS, and other security standards.

These updated packages upgrade NSS from the previous version, 3.12.2, to a prerelease of version 3.12.4. The version of NSPR has also been upgraded from 4.7.3 to 4.7.4.

Moxie Marlinspike reported a heap overflow flaw in a regular expression parser in the NSS library used by browsers such as Mozilla Firefox to match common names in certificates. A malicious website could present a carefully-crafted certificate in such a way as to trigger the heap overflow, leading to a crash or, possibly, arbitrary code execution with the permissions of the user running the browser.
(CVE-2009-2404)

Note: in order to exploit this issue without further user interaction in Firefox, the carefully-crafted certificate would need to be signed by a Certificate Authority trusted by Firefox, otherwise Firefox presents the victim with a warning that the certificate is untrusted.
Only if the user then accepts the certificate will the overflow take place.

Dan Kaminsky discovered flaws in the way browsers such as Firefox handle NULL characters in a certificate. If an attacker is able to get a carefully-crafted certificate signed by a Certificate Authority trusted by Firefox, the attacker could use the certificate during a man-in-the-middle attack and potentially confuse Firefox into accepting it by mistake. (CVE-2009-2408)

Dan Kaminsky found that browsers still accept certificates with MD2 hash signatures, even though MD2 is no longer considered a cryptographically strong algorithm. This could make it easier for an attacker to create a malicious certificate that would be treated as trusted by a browser. NSS now disables the use of MD2 and MD4 algorithms inside signatures by default. (CVE-2009-2409)

All users of nspr and nss are advised to upgrade to these updated packages, which resolve these issues.

USN-810-1 fixed vulnerabilities in NSS. Jozsef Kadlecsik noticed that the new libraries on amd64 did not correctly set stack memory flags, and caused applications using NSS (e.g. Firefox) to have an executable stack. This reduced the effectiveness of some defensive security protections. This update fixes the problem.

We apologize for the inconvenience.

Moxie Marlinspike discovered that NSS did not properly handle regular expressions in certificate names. A remote attacker could create a specially crafted certificate to cause a denial of service (via application crash) or execute arbitrary code as the user invoking the program. (CVE-2009-2404)

Moxie Marlinspike and Dan Kaminsky independently discovered that NSS did not properly handle certificates with NULL characters in the certificate name. An attacker could exploit this to perform a man in the middle attack to view sensitive information or alter encrypted communications.
(CVE-2009-2408)

Dan Kaminsky discovered NSS would still accept certificates with MD2 hash signatures. As a result, an attacker could potentially create a malicious trusted certificate to impersonate another site. (CVE-2009-2409).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

From Red Hat Security Advisory 2009:1431 :

Updated SeaMonkey packages that fix several security issues are now available for Red Hat Enterprise Linux 4.

This update has been rated as having critical security impact by the Red Hat Security Response Team.

SeaMonkey is an open source Web browser, email and newsgroup client, IRC chat client, and HTML editor.

Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause SeaMonkey to crash or, potentially, execute arbitrary code with the privileges of the user running SeaMonkey. (CVE-2009-3072, CVE-2009-3075)

A use-after-free flaw was found in SeaMonkey. An attacker could use this flaw to crash SeaMonkey or, potentially, execute arbitrary code with the privileges of the user running SeaMonkey. (CVE-2009-3077)

Descriptions in the dialogs when adding and removing PKCS #11 modules were not informative. An attacker able to trick a user into installing a malicious PKCS #11 module could use this flaw to install their own Certificate Authority certificates on a user's machine, making it possible to trick the user into believing they are viewing a trusted site or, potentially, execute arbitrary code with the privileges of the user running SeaMonkey. (CVE-2009-3076)

A flaw was found in the way SeaMonkey displays the address bar when window.open() is called in a certain way. An attacker could use this flaw to conceal a malicious URL, possibly tricking a user into believing they are viewing a trusted site. (CVE-2009-2654)

All SeaMonkey users should upgrade to these updated packages, which correct these issues. After installing the update, SeaMonkey must be restarted for the changes to take effect.

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2009-1186 advisory.

    nspr:
    [4.7.4-1.el5_3.1]
    - create z-stream version

    [4.7.4-1]
    - Update to NSPR 4.7.4

    nss:
    [3.12.3.99.3-1.0.1.el5_3.2]
    - Update clean.gif in the nss-3.12.3.99.3-stripped.tar.bz2 tarball

    [3.12.3.99.3-1.el5_3.2]
    - adjust ssl cipher count constant (bug 505650)

    [3.12.3.99.3-1.el5_3.1]
    - create z-stream version

    [3.12.3.99.3-1]
    - updated to NSS_3_12_4_FIPS1_WITH_CKBI_1_75

    [3.12.3-5]
    - updated patch to seckey

    [3.12.3-4]
    - add a patch to seckey

    [3.12.3-3]
    - remove references to SEED

    [3.12.3-2]
    - update to NSS 3.12.3

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
41011	openSUSE Security Update : MozillaThunderbird (MozillaThunderbird-1303)	Nessus	SuSE Local Security Checks	2009/9/18	2021/1/14	medium
41042	openSUSE Security Update : mutt (mutt-1298)	Nessus	SuSE Local Security Checks	2009/9/22	2021/1/14	medium
41419	SuSE 11 Security Update : Mozilla Firefox (SAT Patch Number 1199)	Nessus	SuSE Local Security Checks	2009/9/24	2021/1/14	high
42013	openSUSE 10 Security Update : libfreebl3 (libfreebl3-6494)	Nessus	SuSE Local Security Checks	2009/10/6	2021/1/14	high
42202	openSUSE Security Update : seamonkey (seamonkey-1364)	Nessus	SuSE Local Security Checks	2009/10/22	2021/1/14	high
42317	openSUSE Security Update : libneon-devel (libneon-devel-1377)	Nessus	SuSE Local Security Checks	2009/10/30	2021/1/14	medium
42327	openSUSE 10 Security Update : seamonkey (seamonkey-6538)	Nessus	SuSE Local Security Checks	2009/10/30	2021/1/14	high
60665	Scientific Linux Security Update : seamonkey on SL3.x, SL4.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	2012/8/1	2021/1/14	critical
63889	RHEL 5 : nspr and nss (RHSA-2009:1207)	Nessus	Red Hat Local Security Checks	2013/1/24	2021/1/14	high
65117	Ubuntu 8.04 LTS / 8.10 / 9.04 : nss regression (USN-810-3)	Nessus	Ubuntu Local Security Checks	2013/3/9	2021/1/19	high
67923	Oracle Linux 4 : seamonkey (ELSA-2009-1431)	Nessus	Oracle Linux Local Security Checks	2013/7/12	2021/1/14	critical
180617	Oracle Linux 5 : nspr / and / nss (ELSA-2009-1186)	Nessus	Oracle Linux Local Security Checks	2023/9/7	2024/10/22	medium

検出

プラグインの検索

medium

medium

high

high

high

medium

high

critical

high

high

critical

medium