3 ms·

> I'm staying put on version 52.9.1 You are 18 months behind on security updates for an internet-facing program. You are vulnerable to RCE, as CVE-2019-17026 i

by mappu 7y ago

> I'm staying put on version 52.9.1 You are 18 months behind on security updates for an internet-facing program. You are vulnerable to RCE, as CVE-2019-17026 is actively being exploited (among others, as the most recent example). Is your email address mentioned anywhere online? Public Git commits? Do you ever see spam in your client? In 2020 it is unfortunately simply not valid behaviour to use old versions of software,

mixmastamyk 7y ago
A bit overstated. It’s not a server and that flaw is firefox’s, likely won’t affect TB due to html sanitizing.
- mappu 7y ago
  I don't think it matters whether your PC is a server, attacks using publicly known exploits are generally indiscriminate. Re: CVE-2019-17026 - Mozilla themselves state that it affects Thunderbird, but you're right, these JS issues might not be possible to exploit with just a malicious email as the attack vector. So how about CVE-2019-11703, CVE-2019-11704, CVE-2019-11705 (aka MFSA2019-17)? It's a serious issue that gives RCE in Thunderbird 52.9.1. Is this issue reachable from an *.ics attachment, or will something happen without interaction if you have Lightning installed or receive a malicious calendar invite? This is still quite new and the bugzilla is still private. CVE-2019-11713 gives RCE if any embedded images are reached over HTTP/2, that seems very plausible. At least you have the defense that images aren't loaded by default. Do you ever load images in emails? CVE-2018-18500 is an older RCE but unpatched as well. This one is really interesting - I don't know if custom HTML elements are rendered in emails, but this issue happens in the parser before rendering so it's probably exploitable, the HTML is always parsed at least. Less interesting but still plausible are the ones like CVE-2019-11740 and CVE-2019-11709 and their ilk, there's a new one of these with every Firefox platform update where nobody has (publicly) researched the details, but the patch is there for reversing so given the economic calculus I'm sure someone out there has put the effort in. And finishing off with CVE-2019-11707 and other Javascript things like that, if you have any extensions installed that can be convinced to call the affected function in an exploitable way. If you're stuck on 52.x it's likely for extension reasons, and it's also likely your extensions themselves are no longer getting updates and have their own attack surface. Having looked into the list of CVEs more closely, this is an impressively short list for a 18-month old version of any program (skipping over all the XSS issues and sandbox escapes). But I would give up extensions in a heartbeat versus trusting my personal email account to any one of these.
  - JohnFen 7y ago
    I do not allow HTML to be rendered, nor do I allow Javascript. Email needs neither of those things. Nor do I ever allow images to be rendered in email, external links to be followed, and I don't click any links in an email.
JohnFen 7y ago
Yes, I'm aware of that. Given the way I use Thunderbird, none of the disclosed vulnerabilities affect me, so I'm not terribly worried at this time. Should one appear that does affect me, I'll reevaluate what I'm doing. > In 2020 it is unfortunately simply not valid behaviour to use old versions of software How true that is depends on the software and your use of it. Should the old version of TB pose an unacceptable risk, then I'll move on to something else.

by mappu 7y ago

mixmastamyk 7y ago

A bit overstated. It’s not a server and that flaw is firefox’s, likely won’t affect TB due to html sanitizing.

mappu 7y ago
I don't think it matters whether your PC is a server, attacks using publicly known exploits are generally indiscriminate. Re: CVE-2019-17026 - Mozilla themselves state that it affects Thunderbird, but you're right, these JS issues might not be possible to exploit with just a malicious email as the attack vector. So how about CVE-2019-11703, CVE-2019-11704, CVE-2019-11705 (aka MFSA2019-17)? It's a serious issue that gives RCE in Thunderbird 52.9.1. Is this issue reachable from an *.ics attachment, or will something happen without interaction if you have Lightning installed or receive a malicious calendar invite? This is still quite new and the bugzilla is still private. CVE-2019-11713 gives RCE if any embedded images are reached over HTTP/2, that seems very plausible. At least you have the defense that images aren't loaded by default. Do you ever load images in emails? CVE-2018-18500 is an older RCE but unpatched as well. This one is really interesting - I don't know if custom HTML elements are rendered in emails, but this issue happens in the parser before rendering so it's probably exploitable, the HTML is always parsed at least. Less interesting but still plausible are the ones like CVE-2019-11740 and CVE-2019-11709 and their ilk, there's a new one of these with every Firefox platform update where nobody has (publicly) researched the details, but the patch is there for reversing so given the economic calculus I'm sure someone out there has put the effort in. And finishing off with CVE-2019-11707 and other Javascript things like that, if you have any extensions installed that can be convinced to call the affected function in an exploitable way. If you're stuck on 52.x it's likely for extension reasons, and it's also likely your extensions themselves are no longer getting updates and have their own attack surface. Having looked into the list of CVEs more closely, this is an impressively short list for a 18-month old version of any program (skipping over all the XSS issues and sandbox escapes). But I would give up extensions in a heartbeat versus trusting my personal email account to any one of these.
- JohnFen 7y ago
  I do not allow HTML to be rendered, nor do I allow Javascript. Email needs neither of those things. Nor do I ever allow images to be rendered in email, external links to be followed, and I don't click any links in an email.

JohnFen 7y ago

Yes, I'm aware of that. Given the way I use Thunderbird, none of the disclosed vulnerabilities affect me, so I'm not terribly worried at this time. Should one appear that does affect me, I'll reevaluate what I'm doing. > In 2020 it is unfortunately simply not valid behaviour to use old versions of software How true that is depends on the software and your use of it. Should the old version of TB pose an unacceptable risk, then I'll move on to something else.