• Mozilla Project: Firefox
• Mozilla Project: Mozilla
• Mozilla Project: Thunderbird

Two vulnerabilities have been uncovered affecting different browsers of Mozilla Project.

Impact

In the first vulnerability uncovered a remote attacker could cause overwriting of certificates in the client's certificate store, preventing the user from accessing SSL websites. In the second vulnerability uncovered, a remote attacker could cause the client to crash or potentially execute arbitrary code by sending a specially crafted POP3 response to an affected client.

1. Mozilla fails to validate the Distinguished Name of X.509 certificates CAN-2004-0758

A vulnerability exists in some versions of the Mozilla Project where a self-signed certificate can be imported with the same DN Distinguished Name as an existing root certificate into the user's certificate store. The imported certificate shall override the existing root certificate. This will prevent access to secure SSL websites whose trusted root certificate has been overridden by the malicious certificate in this manner. The attacker can exploit this vulnerability by sending the malicious certificate using email or by hosting the malicious certificate on a website. The exploitation of this vulnerability can automated which shall cause Mozilla to import the certificate without any user intervention.

2. A buffer overflow exists in the SendUidl function of Mozilla CAN-2004-0757

The browsers Mozilla, Firefox, and Thunderbird support Post Office Protocol Version3 POP3 , which is a common mail protocol used for transferring mail from the mail server to the client. A vulnerability has been uncovered in the affected browsers where malformed POP3 responses can trigger a buffer overflow condition in the SendUidl function. Arbitrary

CAN-2004-0758

Upgrade to latest versions. The vulnerability has been fixed in the following versions:
Mozilla 1.7.2
Firefox 0.9.3
Thunderbird 0.7.3

CAN-2004-0757

Upgrade to the latest versions. The vulnerability has been fixed in the following versions:
Mozilla 1.7
Firefox 0.9
Thunderbird 0.7.2.