(PVS) Signatures - Tenable Network Security

Diffie-Hellman mode (DHE) with a very short key length. Such key lengths could be easily
breakable with modern hardware. (MFSA 2010-72)
Solution: Upgrade to Firefox 3.6.11 or later.
CVE-2010-3183
Mozilla Thunderbird 3.0.x < 3.0.9 Multiple Vulnerabilities
PVS ID: 5683 FAMILY: SMTP Clients RISK: HIGH NESSUS ID:50086
Description: Synopsis :\n\nThe remote host has a web browser installed that is vulnerable to multiple
attack vectors.\n\nFor your information, the observed version of Thunderbird is
:%L.\n\nVersions of Thunderbird 3.0.x earlier than 3.0.9 are potentially affected by
multiple vulnerabilities :\n\n - Multiple memory safety bugs could lead to memory
corruption, potentially resulting in arbitrary code execution. (MFSA 2010-64)\n\n - By
passing an excessively long string to 'document.write' it may be possible to trigger a buffer
overflow condition resulting in arbitrary code execution on the remote system. (MFSA
2010-65)\n\n - A use-after-free error in nsBarProp could allow arbitrary code execution on
the remote system. (MFSA 2010-66)\n\n - A dangling pointer vulnerability in
LookupGetterOrSetter could allow arbitrary code execution. (MFSA 2010-67)\n\n - It is
possible to steal information from a site in a different domain using modal calls. (MFSA
2010-69)\n\n - It is possible to establish a valid SSL connection to a remote host, provided
the SSL certificate was created with a common name containing a wild card followed by
the partial IP address of the remote host. (MFSA 2010-70)\n\n - A function used to load
external libraries on the Windows platform could allow loading of unsafe DLL's thus
allowing binary planting attack. (MFSA 2010-71)\n\n - The SSL implementation allows
servers to use Diffie-Hellman mode (DHE) with a very short key length. Such key lengths
could be easily breakable with modern hardware. (MFSA 2010-72)
Solution: Upgrade to Thunderbird 3.0.9 or later.
CVE-2010-3183
Passive Vulnerability Scanner (PVS) Signatures
Mozilla Thunderbird 3.1.x < 3.1.5 Multiple Vulnerabilities
PVS ID: 5684 FAMILY: SMTP Clients RISK: HIGH NESSUS ID:50087
Description: Synopsis :\n\nThe remote host has a web browser installed that is vulnerable to multiple
attack vectors.\n\nFor your information, the observed version of Thunderbird is
:%L.\n\nVersions of Thunderbird 3.1.x earlier than 3.1.5 are potentially affected by
multiple vulnerabilities :\n\n - Multiple memory safety bugs could lead to memory
corruption, potentially resulting in arbitrary code execution. (MFSA 2010-64)\n\n - By
passing an excessively long string to 'document.write' it may be possible to trigger a buffer
overflow condition resulting in arbitrary code execution on the remote system. (MFSA
2010-65)\n\n - A use-after-free error in nsBarProp could allow arbitrary code execution on
the remote system. (MFSA 2010-66)\n\n - A dangling pointer vulnerability in
LookupGetterOrSetter could allow arbitrary code execution. (MFSA 2010-67)\n\n - It is
possible to steal information from a site in a different domain using modal calls. (MFSA
2010-69)\n\n - It is possible to establish a valid SSL connection to a remote host, provided
Family Internet Services 1535