----------------------------------------------------------------------

Monitor, Filter, and Manage Security Information
- Filtering and Management of Secunia advisories
- Overview, documentation, and detailed reports
- Alerting via email and SMS

Request Trial:
https://ca.secunia.com/?f=l

----------------------------------------------------------------------

TITLE:
Mozilla / Thunderbird Valid Email Address Enumeration Weakness

SECUNIA ADVISORY ID:
SA13086

VERIFY ADVISORY:
http://secunia.com/advisories/13086/

CRITICAL:
Not critical

IMPACT:
Exposure of system information

WHERE:
>From remote

SOFTWARE:
Mozilla 1.7.x
http://secunia.com/product/3691/
Mozilla Thunderbird 0.x
http://secunia.com/product/2637/

DESCRIPTION:
plonk has discovered a weakness in Mozilla and Thunderbird, which can
be exploited by malicious people to enumerate valid email addresses.

The weakness is caused due to an improper behaviour where references
to external stylesheets in HTML documents are followed. This can be
exploited to validate the existence of an mail address when a
malicious mail is opened.

The weakness has been confirmed in Mozilla 1.7.3 and Thunderbird 0.8.
Other versions may also be affected.

SOLUTION:
If this is considered a problem, then disable HTML support in
emails:
"View" --> "Message Body As" --> "Plain Text"

PROVIDED AND/OR DISCOVERED BY:
plonk

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------