Mozilla MailNews Client E-Mail Attachment Script Execution Vulnerability

Bugtraq ID:	9331
Class:	Access Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Aug 28 2003 12:00AM
Updated:	Aug 28 2003 12:00AM
Credit:	The disclosure of this issue has been credited to Georgi Guninski.
Vulnerable:	Mozilla Browser 1.2.1 Mozilla Browser 1.2 Beta Mozilla Browser 1.2 Alpha Mozilla Browser 1.2 Mozilla Browser 1.1 Beta Mozilla Browser 1.1 Alpha Mozilla Browser 1.1 Mozilla Browser 1.0.2 + Redhat Advanced Workstation for the Itanium Processor 2.1 + Redhat Advanced Workstation for the Itanium Processor 2.1 + Redhat Enterprise Linux AS 2.1 IA64 + Redhat Enterprise Linux AS 2.1 IA64 + Redhat Enterprise Linux AS 2.1 + Redhat Enterprise Linux AS 2.1 + Redhat Enterprise Linux ES 2.1 IA64 + Redhat Enterprise Linux ES 2.1 IA64 + Redhat Enterprise Linux ES 2.1 + Redhat Enterprise Linux ES 2.1 + Redhat Enterprise Linux WS 2.1 IA64 + Redhat Enterprise Linux WS 2.1 IA64 + Redhat Enterprise Linux WS 2.1 + Redhat Enterprise Linux WS 2.1 + Sun Linux 5.0.7 Mozilla Browser 1.0.1 Mozilla Browser 1.0 RC2 Mozilla Browser 1.0 RC1 - FreeBSD FreeBSD 4.5 - FreeBSD FreeBSD 4.4 - FreeBSD FreeBSD 4.3 - FreeBSD FreeBSD 4.2 - FreeBSD FreeBSD 4.1.1 Mozilla Browser 1.0 + Mandriva Linux Mandrake 8.2 ppc + Mandriva Linux Mandrake 8.2 + Redhat Linux 8.0 i386 + Redhat Linux 8.0 Mozilla Browser 0.9.48 Mozilla Browser 0.9.35 Mozilla Browser 0.9.9 - FreeBSD FreeBSD 4.5 - FreeBSD FreeBSD 4.4 - FreeBSD FreeBSD 4.3 - FreeBSD FreeBSD 4.2 - FreeBSD FreeBSD 4.1.1 + Redhat Linux 7.3 i386 + Redhat Linux 7.3 + Redhat Linux 7.2 i686 + Redhat Linux 7.2 i586 + Redhat Linux 7.2 i386 + Redhat Linux 7.2 Mozilla Browser 0.9.8 - Apple Mac OS 9 9.2.2 - Apple Mac OS 9 9.2.1 - Apple Mac OS 9 9.2.1 - Apple Mac OS 9 9.2 - Apple Mac OS 9 9.2 - Apple Mac OS 9 9.1 - Apple Mac OS 9 9.1 - Apple Mac OS 9 9.0.4 - Apple Mac OS 9 9.0.4 - Apple Mac OS 9 9.0 - Apple Mac OS 9 9.0 - Apple Mac OS X 10.1.2 - Apple Mac OS X 10.1.2 - Apple Mac OS X 10.1.1 - Apple Mac OS X 10.1.1 - Apple Mac OS X 10.1 - Apple Mac OS X 10.1 - Apple Mac OS X 10.1 - Apple Mac OS X 10.1 - Apple Mac OS X 10.0.4 - Apple Mac OS X 10.0.4 - Apple Mac OS X 10.0.3 - Apple Mac OS X 10.0.3 - Apple Mac OS X 10.0.2 - Apple Mac OS X 10.0.2 - Apple Mac OS X 10.0.1 - Apple Mac OS X 10.0.1 - Apple Mac OS X 10.0 - Apple Mac OS X 10.0 - Microsoft Windows 95 - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows 98 - Microsoft Windows ME - Microsoft Windows ME - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP6 - Microsoft Windows NT 4.0 SP6 - Microsoft Windows NT 4.0 SP5 - Microsoft Windows NT 4.0 SP5 - Microsoft Windows NT 4.0 SP4 - Microsoft Windows NT 4.0 SP4 - Microsoft Windows NT 4.0 SP3 - Microsoft Windows NT 4.0 SP3 - Microsoft Windows NT 4.0 SP2 - Microsoft Windows NT 4.0 SP2 - Microsoft Windows NT 4.0 SP1 - Microsoft Windows NT 4.0 SP1 - Microsoft Windows NT 4.0 - Microsoft Windows NT 4.0 - Microsoft Windows XP 0 Mozilla Browser 0.9.7 - Apple Mac OS 9 9.2.1 - Apple Mac OS 9 9.2.1 - Apple Mac OS 9 9.2 - Apple Mac OS 9 9.2 - Apple Mac OS 9 9.1 - Apple Mac OS 9 9.1 - Apple Mac OS 9 9.0.4 - Apple Mac OS 9 9.0.4 - Apple Mac OS 9 9.0 - Apple Mac OS 9 9.0 - Apple Mac OS X 10.1.2 - Apple Mac OS X 10.1.2 - Apple Mac OS X 10.1.1 - Apple Mac OS X 10.1.1 - Apple Mac OS X 10.1 - Apple Mac OS X 10.1 - Apple Mac OS X 10.0.4 - Apple Mac OS X 10.0.4 - Apple Mac OS X 10.0.3 - Apple Mac OS X 10.0.3 - Apple Mac OS X 10.0.2 - Apple Mac OS X 10.0.2 - Apple Mac OS X 10.0.1 - Apple Mac OS X 10.0.1 - Apple Mac OS X 10.0 - Apple Mac OS X 10.0 - Microsoft Windows 95 - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows 98 - Microsoft Windows ME - Microsoft Windows ME - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP5 - Microsoft Windows NT 4.0 SP5 - Microsoft Windows NT 4.0 SP4 - Microsoft Windows NT 4.0 SP4 - Microsoft Windows NT 4.0 SP3 - Microsoft Windows NT 4.0 SP3 - Microsoft Windows NT 4.0 SP2 - Microsoft Windows NT 4.0 SP2 - Microsoft Windows NT 4.0 SP1 - Microsoft Windows NT 4.0 SP1 - Microsoft Windows NT 4.0 - Microsoft Windows NT 4.0 - Microsoft Windows XP 0 Mozilla Browser 0.9.6 - Apple Mac OS 9 9.2 - Apple Mac OS 9 9.2 - Apple Mac OS 9 9.1 - Apple Mac OS 9 9.1 - Apple Mac OS 9 9.0 - Apple Mac OS 9 9.0 - Be BeOS 5.0 - Be BeOS 5.0 - BSDI BSD/OS 4.2 - BSDI BSD/OS 4.2 - Compaq OpenVMS 7.3 Alpha - Compaq OpenVMS 7.3 Alpha - Compaq OpenVMS 7.2 -2 Alpha - Compaq OpenVMS 7.2 -2 Alpha - Compaq OpenVMS 7.1 -2 Alpha - FreeBSD FreeBSD 4.0 - FreeBSD FreeBSD 4.0 - IBM AIX 4.3.3 - IBM AIX 4.3.3 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 2000 Professional - Microsoft Windows 95 - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows 98 - Microsoft Windows ME - Microsoft Windows ME - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP6 - Microsoft Windows NT 4.0 SP6 - Microsoft Windows NT 4.0 SP5 - Microsoft Windows NT 4.0 SP5 - Microsoft Windows NT 4.0 SP4 - Microsoft Windows NT 4.0 SP4 - Microsoft Windows NT 4.0 SP3 - Microsoft Windows NT 4.0 SP3 - Microsoft Windows NT 4.0 SP2 - Microsoft Windows NT 4.0 SP2 - Microsoft Windows NT 4.0 SP1 - Microsoft Windows NT 4.0 SP1 - Microsoft Windows NT 4.0 - Microsoft Windows NT 4.0 - Redhat Linux 7.0 sparc - Redhat Linux 7.0 sparc - Redhat Linux 7.0 i386 - Redhat Linux 7.0 i386 - Redhat Linux 7.0 alpha - Redhat Linux 7.0 alpha - Redhat Linux 6.0 sparc - Redhat Linux 6.0 sparc - Redhat Linux 6.0 alpha - Redhat Linux 6.0 alpha - Redhat Linux 6.0 - Redhat Linux 6.0 - SGI IRIX 6.5 - SGI IRIX 6.5 - Sun Solaris 2.8 - Sun Solaris 2.8 - Sun Solaris 2.7 - Sun Solaris 2.7 Mozilla Browser 0.9.5 - Apple Mac OS 9 9.2.1 - Apple Mac OS 9 9.2.1 - Apple Mac OS 9 9.2 - Apple Mac OS 9 9.2 - Apple Mac OS 9 9.1 - Apple Mac OS 9 9.1 - Apple Mac OS 9 9.0.4 - Apple Mac OS 9 9.0.4 - Apple Mac OS 9 9.0 - Apple Mac OS 9 9.0 - Apple Mac OS X 10.1.2 - Apple Mac OS X 10.1.2 - Apple Mac OS X 10.1.1 - Apple Mac OS X 10.1 - Apple Mac OS X 10.1 - Apple Mac OS X 10.0.4 - Apple Mac OS X 10.0.4 - Apple Mac OS X 10.0.3 - Apple Mac OS X 10.0.3 - Apple Mac OS X 10.0.2 - Apple Mac OS X 10.0.2 - Apple Mac OS X 10.0.1 - Apple Mac OS X 10.0.1 - Apple Mac OS X 10.0 - Apple Mac OS X 10.0 - Microsoft Windows 95 - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows 98 - Microsoft Windows ME - Microsoft Windows ME - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP5 - Microsoft Windows NT 4.0 SP5 - Microsoft Windows NT 4.0 SP4 - Microsoft Windows NT 4.0 SP4 - Microsoft Windows NT 4.0 SP3 - Microsoft Windows NT 4.0 SP3 - Microsoft Windows NT 4.0 SP2 - Microsoft Windows NT 4.0 SP2 - Microsoft Windows NT 4.0 SP1 - Microsoft Windows NT 4.0 SP1 - Microsoft Windows NT 4.0 - Microsoft Windows NT 4.0 - Microsoft Windows XP 0 Mozilla Browser 0.9.4 .1 - Apple Mac OS 9 9.2.1 - Apple Mac OS 9 9.2.1 - Apple Mac OS 9 9.2 - Apple Mac OS 9 9.2 - Apple Mac OS 9 9.1 - Apple Mac OS 9 9.1 - Apple Mac OS 9 9.0.4 - Apple Mac OS 9 9.0.4 - Apple Mac OS 9 9.0 - Apple Mac OS 9 9.0 - Apple Mac OS X 10.1.2 - Apple Mac OS X 10.1.2 - Apple Mac OS X 10.1.1 - Apple Mac OS X 10.1 - Apple Mac OS X 10.1 - Apple Mac OS X 10.0.4 - Apple Mac OS X 10.0.4 - Apple Mac OS X 10.0.3 - Apple Mac OS X 10.0.3 - Apple Mac OS X 10.0.2 - Apple Mac OS X 10.0.2 - Apple Mac OS X 10.0.1 - Apple Mac OS X 10.0.1 - Apple Mac OS X 10.0 - Apple Mac OS X 10.0 - Microsoft Windows 95 - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows 98 - Microsoft Windows ME - Microsoft Windows ME - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP5 - Microsoft Windows NT 4.0 SP5 - Microsoft Windows NT 4.0 SP4 - Microsoft Windows NT 4.0 SP4 - Microsoft Windows NT 4.0 SP3 - Microsoft Windows NT 4.0 SP3 - Microsoft Windows NT 4.0 SP2 - Microsoft Windows NT 4.0 SP2 - Microsoft Windows NT 4.0 SP1 - Microsoft Windows NT 4.0 SP1 - Microsoft Windows NT 4.0 - Microsoft Windows NT 4.0 - Microsoft Windows XP 0 Mozilla Browser 0.9.4 - Apple Mac OS 9 9.2.1 - Apple Mac OS 9 9.2.1 - Apple Mac OS 9 9.2 - Apple Mac OS 9 9.2 - Apple Mac OS 9 9.1 - Apple Mac OS 9 9.1 - Apple Mac OS 9 9.0.4 - Apple Mac OS 9 9.0.4 - Apple Mac OS 9 9.0 - Apple Mac OS 9 9.0 - Apple Mac OS X 10.1.2 - Apple Mac OS X 10.1.2 - Apple Mac OS X 10.1.1 - Apple Mac OS X 10.1.1 - Apple Mac OS X 10.1 - Apple Mac OS X 10.1 - Apple Mac OS X 10.0.4 - Apple Mac OS X 10.0.4 - Apple Mac OS X 10.0.3 - Apple Mac OS X 10.0.3 - Apple Mac OS X 10.0.2 - Apple Mac OS X 10.0.2 - Apple Mac OS X 10.0.1 - Apple Mac OS X 10.0.1 - Apple Mac OS X 10.0 - Apple Mac OS X 10.0 - Microsoft Windows 95 - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows 98 - Microsoft Windows ME - Microsoft Windows ME - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP5 - Microsoft Windows NT 4.0 SP5 - Microsoft Windows NT 4.0 SP4 - Microsoft Windows NT 4.0 SP4 - Microsoft Windows NT 4.0 SP3 - Microsoft Windows NT 4.0 SP3 - Microsoft Windows NT 4.0 SP2 - Microsoft Windows NT 4.0 SP2 - Microsoft Windows NT 4.0 SP1 - Microsoft Windows NT 4.0 SP1 - Microsoft Windows NT 4.0 - Microsoft Windows NT 4.0 - Microsoft Windows XP 0 Mozilla Browser 0.9.3 - Apple Mac OS 9 9.2.1 - Apple Mac OS 9 9.2.1 - Apple Mac OS 9 9.2 - Apple Mac OS 9 9.2 - Apple Mac OS 9 9.1 - Apple Mac OS 9 9.1 - Apple Mac OS 9 9.0.4 - Apple Mac OS 9 9.0.4 - Apple Mac OS 9 9.0 - Apple Mac OS 9 9.0 - Apple Mac OS X 10.1.2 - Apple Mac OS X 10.1.2 - Apple Mac OS X 10.1.1 - Apple Mac OS X 10.1 - Apple Mac OS X 10.1 - Apple Mac OS X 10.0.4 - Apple Mac OS X 10.0.4 - Apple Mac OS X 10.0.3 - Apple Mac OS X 10.0.3 - Apple Mac OS X 10.0.2 - Apple Mac OS X 10.0.2 - Apple Mac OS X 10.0.1 - Apple Mac OS X 10.0.1 - Apple Mac OS X 10.0 - Apple Mac OS X 10.0 - Microsoft Windows 95 - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows 98 - Microsoft Windows ME - Microsoft Windows ME - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP5 - Microsoft Windows NT 4.0 SP5 - Microsoft Windows NT 4.0 SP4 - Microsoft Windows NT 4.0 SP4 - Microsoft Windows NT 4.0 SP3 - Microsoft Windows NT 4.0 SP3 - Microsoft Windows NT 4.0 SP2 - Microsoft Windows NT 4.0 SP2 - Microsoft Windows NT 4.0 SP1 - Microsoft Windows NT 4.0 SP1 - Microsoft Windows NT 4.0 - Microsoft Windows NT 4.0 - Microsoft Windows XP 0 Mozilla Browser 0.9.2 .1 - Apple Mac OS 9 9.2.1 - Apple Mac OS 9 9.2.1 - Apple Mac OS 9 9.2 - Apple Mac OS 9 9.2 - Apple Mac OS 9 9.1 - Apple Mac OS 9 9.1 - Apple Mac OS 9 9.0.4 - Apple Mac OS 9 9.0.4 - Apple Mac OS 9 9.0 - Apple Mac OS 9 9.0 - Apple Mac OS X 10.1.2 - Apple Mac OS X 10.1.2 - Apple Mac OS X 10.1.1 - Apple Mac OS X 10.1 - Apple Mac OS X 10.1 - Apple Mac OS X 10.0.4 - Apple Mac OS X 10.0.4 - Apple Mac OS X 10.0.3 - Apple Mac OS X 10.0.3 - Apple Mac OS X 10.0.2 - Apple Mac OS X 10.0.2 - Apple Mac OS X 10.0.1 - Apple Mac OS X 10.0.1 - Apple Mac OS X 10.0 - Apple Mac OS X 10.0 - Microsoft Windows 95 - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows 98 - Microsoft Windows ME - Microsoft Windows ME - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP5 - Microsoft Windows NT 4.0 SP5 - Microsoft Windows NT 4.0 SP4 - Microsoft Windows NT 4.0 SP4 - Microsoft Windows NT 4.0 SP3 - Microsoft Windows NT 4.0 SP3 - Microsoft Windows NT 4.0 SP2 - Microsoft Windows NT 4.0 SP2 - Microsoft Windows NT 4.0 SP1 - Microsoft Windows NT 4.0 SP1 - Microsoft Windows NT 4.0 - Microsoft Windows NT 4.0 - Microsoft Windows XP 0 Mozilla Browser 0.9.2 - Apple Mac OS 9 9.2.1 - Apple Mac OS 9 9.2.1 - Apple Mac OS 9 9.2 - Apple Mac OS 9 9.2 - Apple Mac OS 9 9.1 - Apple Mac OS 9 9.1 - Apple Mac OS 9 9.0.4 - Apple Mac OS 9 9.0.4 - Apple Mac OS 9 9.0 - Apple Mac OS 9 9.0 - Apple Mac OS X 10.1.2 - Apple Mac OS X 10.1.2 - Apple Mac OS X 10.1.1 - Apple Mac OS X 10.1.1 - Apple Mac OS X 10.1 - Apple Mac OS X 10.1 - Apple Mac OS X 10.0.4 - Apple Mac OS X 10.0.4 - Apple Mac OS X 10.0.3 - Apple Mac OS X 10.0.3 - Apple Mac OS X 10.0.2 - Apple Mac OS X 10.0.2 - Apple Mac OS X 10.0.1 - Apple Mac OS X 10.0.1 - Apple Mac OS X 10.0 - Apple Mac OS X 10.0 - Microsoft Windows 95 - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows 98 - Microsoft Windows ME - Microsoft Windows ME - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP5 - Microsoft Windows NT 4.0 SP5 - Microsoft Windows NT 4.0 SP4 - Microsoft Windows NT 4.0 SP4 - Microsoft Windows NT 4.0 SP3 - Microsoft Windows NT 4.0 SP3 - Microsoft Windows NT 4.0 SP2 - Microsoft Windows NT 4.0 SP2 - Microsoft Windows NT 4.0 SP1 - Microsoft Windows NT 4.0 SP1 - Microsoft Windows NT 4.0 - Microsoft Windows NT 4.0 - Microsoft Windows XP 0 Mozilla Browser 0.8 + Mandriva Linux Mandrake 8.0 ppc + Mandriva Linux Mandrake 8.0 Mozilla Browser M16 Mozilla Browser M15
Not Vulnerable:

Mozilla MailNews Client E-Mail Attachment Script Execution Vulnerability

It has been reported that Mozilla MailNews Client is prone to a vulnerability that may allow an attacker to execute arbitrary script code with system privileges on a vulnerable host.

The issue presents itself when a user opens or saves a specially crafted e-mail attachment sent by an attacker. Successful exploitation of this issue may allow an attacker to execute arbitrary script code with system privileges on a vulnerable system.

Mozilla MailNews Client E-Mail Attachment Script Execution Vulnerability

Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Mozilla MailNews Client E-Mail Attachment Script Execution Vulnerability

Solution:
This issue has been fixed in Mozilla 1.3. Users are advised to upgrade to the fixed version.

Mozilla MailNews Client E-Mail Attachment Script Execution Vulnerability

References:

• Known Vulnerabilities in Mozilla (Mozilla)
  
• Mozilla Homepage (Mozilla Foundation)