======================================================================

                     Secunia Research 17/01/2006

       - Mozilla Thunderbird Attachment Spoofing Vulnerability -

======================================================================
Table of Contents

Affected Software....................................................1
Severity.............................................................2
Description of Vulnerability.........................................3
Solution.............................................................4
Time Table...........................................................5
Credits..............................................................6
References...........................................................7
About Secunia........................................................8
Verification.........................................................9

======================================================================
1) Affected Software

Mozilla Thunderbird versions 1.0.2, 1.0.6, 
and 1.0.7 for Microsoft Windows.

Other versions may also be affected.

======================================================================
2) Severity

Rating: Less critical
Impact: Spoofing
        System access
Where:  From remote

======================================================================
3) Description of Vulnerability

Secunia Research has discovered a vulnerability in Thunderbird, which 
can be exploited by malicious people to trick users into executing 
arbitrary programs.

The vulnerability is caused due to attachments not being displayed 
correctly in mails. This can be exploited to spoof the file extension 
and the associated file type icon via a combination of overly long 
filenames containing whitespaces and "Content-Type" headers not 
matching the file extension.

Successful exploitation may lead to malware being saved to e.g. the 
desktop.

NOTE: Attachments can be saved by dragging the attachment, or using 
the "Save As..." or "Save All..." functionality. For files on the 
desktop the icon can be spoofed if it e.g. is a ".exe" or 
".lnk" file.

The vulnerability has been confirmed in versions 1.0.2, 1.0.6, and 
1.0.7 for Microsoft Windows. Other versions may also be affected.

======================================================================
4) Solution

Update to version 1.5.
http://www.mozilla.com/thunderbird/

======================================================================
5) Time Table

01/07/2005 - Initial vendor notification.
10/07/2005 - Vendor confirms the vulnerability.
27/07/2005 - Vulnerability fixed in the CVS repository.
12/01/2006 - Thunderbird 1.5 released.
17/01/2006 - Public disclosure.

======================================================================
6) Credits

Discovered by Andreas Sandblad, Secunia Research.

======================================================================
7) References

https://bugzilla.mozilla.org/show_bug.cgi?id=300246

======================================================================
8) About Secunia

Secunia collects, validates, assesses, and writes advisories regarding
all the latest software vulnerabilities disclosed to the public. These
advisories are gathered in a publicly available database at the
Secunia web site:

http://secunia.com/

Secunia offers services to our customers enabling them to receive all
relevant vulnerability information to their specific system
configuration.

Secunia offers a FREE mailing list called Secunia Security Advisories:

http://secunia.com/secunia_security_advisories/

======================================================================
9) Verification

Please verify this advisory by visiting the Secunia web site:
http://secunia.com/secunia_research/2005-22/advisory/

Complete list of vulnerability reports released by Secunia Research:
http://secunia.com/secunia_research/

=====================================================================