发布日期：2007-02-23
更新日期：2008-03-17

受影响系统：

Mozilla Firefox 2.x
Mozilla Firefox 1.x
Mozilla Thunderbird <  1.5.0.10
Mozilla SeaMonkey < 1.0.8

描述：

---

CVE(CAN) ID: CVE-2007-0008

Firefox是一款非常流行的开源WEB浏览器。Thunderbird是一个邮件客户端，支持IMAP、POP邮件协议以及HTML邮件格式。

Mozilla Firefox, Mozilla Network Security Services (NSS), Mozilla SeaMonkey, Mozilla Thunderbird的多个版本存在远程溢出漏洞，此漏洞源于NSS代码内的错误，处理某些SSLv2服务器消息可触发此漏洞。产品没有正确处理SSL服务器证书，该证书RSA公钥太小，不能加密整个SSLv2 Master Secret，导致了堆缓冲区溢出和任意代码执行。

<*来源：regenrecht
  
  链接：http://www.osvdb.org/32105
*>

建议：

---

厂商补丁：

Mozilla
-------
目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：

http://www.mozilla.org/security/

Mozilla Firefox 1.5.0.3
Mozilla Firefox 1.5.0.10
http://www.mozilla.com/products/download.html?product=firefox-1.5.0.10 &os=win&lang=en-US

SuSE MozillaFirefox-1.5.0.10-0.2.i586.rpm
SUSE LINUX 10.1:
ftp://ftp.suse.com/pub/suse/update/10.1/rpm/i586/MozillaFirefox-1.5.0. 10-0.2.i586.rpm

SuSE MozillaFirefox-1.5.0.10-0.2.ppc.rpm
openSUSE 10.2:
ftp://ftp.suse.com/pub/suse/update/10.1/rpm/ppc/MozillaFirefox-1.5.0.1 0-0.2.ppc.rpm

SuSE MozillaFirefox-translations-1.5.0.10-0.2.i586.rpm
SUSE LINUX 10.1:
ftp://ftp.suse.com/pub/suse/update/10.1/rpm/i586/MozillaFirefox-transl ations-1.5.0.10-0.2.i586.rpm

SuSE MozillaFirefox-translations-1.5.0.10-0.2.ppc.rpm
openSUSE 10.2:
ftp://ftp.suse.com/pub/suse/update/10.1/rpm/ppc/MozillaFirefox-transla tions-1.5.0.10-0.2.ppc.rpm


Mozilla Thunderbird 1.5.0.5
Mozilla Thunderbird 1.5.0.10
http://www.mozilla.com/products/download.html?product=thunderbird-1.5. 0.10&os=linux&lang=en-US


Mozilla Firefox 1.5.0.2
Mozilla Firefox 1.5.0.10
http://www.mozilla.com/products/download.html?product=firefox-1.5.0.10 &os=win&lang=en-US


Mozilla Firefox 2.0 RC2
Mozilla Firefox 2.0.0.2
http://www.mozilla.com/products/download.html?product=firefox-2.0.0.2& os=linux&lang=en-US


Mozilla Thunderbird 1.5.0.8
Mozilla Thunderbird 1.5.0.10
http://www.mozilla.com/products/download.html?product=thunderbird-1.5. 0.10&os=linux&lang=en-US

RedHat Fedora thunderbird-1.5.0.10-1.fc5.i386.rpm
Fedora Core 5
http://download.fedora.redhat.com/pub/fedora/linux/core/updates/5/

RedHat Fedora thunderbird-1.5.0.10-1.fc5.ppc.rpm
Fedora Core 5
http://download.fedora.redhat.com/pub/fedora/linux/core/updates/5/

RedHat Fedora thunderbird-1.5.0.10-1.fc5.x86_64.rpm
Fedora Core 5
http://download.fedora.redhat.com/pub/fedora/linux/core/updates/5/

RedHat Fedora thunderbird-debuginfo-1.5.0.10-1.fc5.i386.rpm
Fedora Core 5
http://download.fedora.redhat.com/pub/fedora/linux/core/updates/5/

RedHat Fedora thunderbird-debuginfo-1.5.0.10-1.fc5.ppc.rpm
Fedora Core 5
http://download.fedora.redhat.com/pub/fedora/linux/core/updates/5/

RedHat Fedora thunderbird-debuginfo-1.5.0.10-1.fc5.x86_64.rpm
Fedora Core 5
http://download.fedora.redhat.com/pub/fedora/linux/core/updates/5/

SuSE MozillaThunderbird-1.5.0.10-1.1.i586.rpm
openSUSE 10.2:
ftp://ftp.suse.com/pub/suse/update/10.2/rpm/i586/MozillaThunderbird-1. 5.0.10-1.1.i586.rpm

SuSE MozillaThunderbird-1.5.0.10-1.1.ppc.rpm
openSUSE 10.2:
ftp://ftp.suse.com/pub/suse/update/10.1/rpm/ppc/MozillaThunderbird-1.5 .0.10-1.1.ppc.rpm

SuSE MozillaThunderbird-1.5.0.10-1.1.ppc.rpm
SUSE LINUX 10.1:
ftp://ftp.suse.com/pub/suse/update/10.1/rpm/ppc/MozillaThunderbird-1.5 .0.10-1.1.ppc.rpm

SuSE MozillaThunderbird-1.5.0.10-1.1.ppc.rpm
openSUSE 10.2:
ftp://ftp.suse.com/pub/suse/update/10.2/rpm/ppc/MozillaThunderbird-1.5 .0.10-1.1.ppc.rpm

SuSE MozillaThunderbird-translations-1.5.0.10-1.1.i586.rpm
openSUSE 10.2:
ftp://ftp.suse.com/pub/suse/update/10.2/rpm/i586/MozillaThunderbird-tr anslations-1.5.0.10-1.1.i586.rpm

SuSE MozillaThunderbird-translations-1.5.0.10-1.1.ppc.rpm
SUSE LINUX 10.1:
ftp://ftp.suse.com/pub/suse/update/10.1/rpm/ppc/MozillaThunderbird-tra nslations-1.5.0.10-1.1.ppc.rpm

SuSE MozillaThunderbird-translations-1.5.0.10-1.1.ppc.rpm
openSUSE 10.2:
ftp://ftp.suse.com/pub/suse/update/10.2/rpm/ppc/MozillaThunderbird-tra nslations-1.5.0.10-1.1.ppc.rpm

浏览次数：1851
严重程度：0（网友投票）