SkipNavigation
US-CERT
American Flag
  Vulnerability
Notes
Database

Search Vulnerability Notes

Vulnerability Notes Help Information


 
 View Notes By
  Name

ID Number

CVE Name

Date Public

Date Published

Date Updated

Severity Metric



 Other Documents
  Technical Alerts

Technical Bulletins

Alerts

Security Tips

 

Vulnerability Note VU#414240

Mozilla Mail vulnerable to buffer overflow via "writeGroup()" function in "nsVCardObj.cpp"

Overview

Mozilla Mail contains a vulnerability in the display routines for VCards. By sending an email message with a crafted VCard, a remote attacker may be able to execute arbitrary code on the victim's machine with the privileges of the current user.

I. Description

Mozilla Mail contains a stack overflow vulnerability in the display routines for VCards. By sending an email message with a crafted VCard, a remote attacker may be able to execute arbitrary code on the victim's machine with the privileges of the current user. This can be exploited in the preview mode as well.

II. Impact

A remote attacker may be able to execute arbitrary code on the victim's machine with the privileges of the current user.

III. Solution

This vulnerability is resolved in Firefox Preview Release, Mozilla 1.7.3, and Thunderbird 0.8.

Until a patch or upgrade can be performed, Mozilla recommends the following workaround; Disable in-line display of attachments, don't open VCard attachments.

Systems Affected

VendorStatusDate Updated
MozillaNot Vulnerable17-Sep-2004

References


http://secunia.com/advisories/12526/
http://bugzilla.mozilla.org/show_bug.cgi?id=257314
http://www.mozilla.org/projects/security/known-vulnerabilities.html
http://www.securitytracker.com/alerts/2004/Sep/1011317.html
http://www.securitytracker.com/alerts/2004/Sep/1011318.html

Credit

Thanks to Georgi Guninski for reporting this vulnerability.

This document was written by Jason A Rafail.

Other Information

Date Public09/14/2004
Date First Published09/17/2004 02:03:01 PM
Date Last Updated09/17/2004
CERT Advisory 
CVE Name 
US-CERT Technical Alerts 
Metric32.40
Document Revision8

If you have feedback, comments, or additional information about this vulnerability, please send us email.
 

 
Page Corner Image
Copyright 2004 Carnegie Mellon University
Disclaimers and copyright information
Get Adobe Reader Get Adobe Reader