Thunderbird 'IE' Fix

The Mozilla organization has released an update to its Thunderbird 2.x e-mail client that fixes two critical security holes. These same fixes were also recently implemented in Firefox 2.0.0.5.

At that time, one of these holes generated a bit of controversy when researchers found an exploit that could take advantage of apparent flaws in both Firefox and Internet Explorer in a play to take over a user's PC remotely. (I discussed this at the time in an earlier posting.)

The two parties had a somewhat public row over whose problem it was.

The folks at Mozilla responded quickly and patched their end of the hole.

Microsoft is still saying that there's no bug that needs to be patched in IE at all. (I suspect, however, Microsoft will quietly come out with some kind of patch in the next few months that will fix or somehow mitigate the problem.)

It does seem logical that any time you have an interaction between two programs, especially ones involved in communications on the Web ? for example, one browser providing services to another ? what security researchers call the "attack surface" ? the number of possibly exploitable programming interfaces left exposed for another program to try to use to gain entry -- is expanded.

So we're likely to see more security flaws discovered in the near future that are based on unfortunate synergies between two or more programs interacting, especially involving IE.

Luckily, despite its "zero-day" status, there haven't been any reported attacks "in the wild" based on this hole so far. But as always, it's especially important to stay up to date on security fixes.

You can get the Thunderbird 2.0.0.5 update for Windows, Mac, and Linux from its download site.

If you already have Thunderbird 2.0.0.x, you should receive an automated update notification, according to Mozilla's alert.

You can learn more about the security fixes in Thunderbird 2.0.0.5 at Mozilla's security advisories page.

One other thing: The security vulnerabilities fixed in Thunderbird 2.0.0.5 don't impact you if you use Thunderbird 1.5.0.x so there's no update needed for Thunderbird 1.5.0.x series users.

Comments

Post a comment Post a comment

0 / 1000 max characters