CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:L/Au:N/C:C/I:C/A:C
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS
Percentile
96.5%
The installed version of Thunderbird ESR 17.x is earlier than 17.0.7 and is, therefore, potentially affected the following vulnerabilities:
Various, unspecified memory safety issues exist.
(CVE-2013-1682)
Heap-use-after-free errors exist related to βLookupMediaElementURITableβ, βnsIDocument::GetRootElementβ and βmozilla::ResetDirβ.
(CVE-2013-1684, CVE-2013-1685, CVE-2013-1686)
An error exists related to βXBL scopeβ, βSystem Only Wrappersβ (SOW) and chrome-privileged pages that could allow cross-site scripting attacks. (CVE-2013-1687)
An error related to βonreadystatechangeβ and unmapped memory could cause application crashes and allow arbitrary code execution. (CVE-2013-1690)
The application sends data in the body of XMLHttpRequest (XHR) HEAD requests and could aid in cross-site request forgery attacks. (CVE-2013-1692)
An error related to the processing of SVG content could allow a timing attack to disclose information across domains. (CVE-2013-1693)
An error exists related to βPreserveWrapperβ and the βpreserved-wrapperβ flag that could cause potentially exploitable application crashes. (CVE-2013-1694)
An error exists related to the βtoStringβ and βvalueOfβ methods that could allow βXrayWrappersβ to be bypassed.
(CVE-2013-1697)
#%NASL_MIN_LEVEL 70300
#
# (C) Tenable Network Security, Inc.
#
include('deprecated_nasl_level.inc');
include('compat.inc');
if (description)
{
script_id(66995);
script_version("1.14");
script_set_attribute(attribute:"plugin_modification_date", value:"2022/03/29");
script_cve_id(
"CVE-2013-1682",
"CVE-2013-1684",
"CVE-2013-1685",
"CVE-2013-1686",
"CVE-2013-1687",
"CVE-2013-1690",
"CVE-2013-1692",
"CVE-2013-1693",
"CVE-2013-1694",
"CVE-2013-1697"
);
script_bugtraq_id(
60765,
60766,
60773,
60774,
60776,
60777,
60778,
60783,
60784,
60787
);
script_xref(name:"CISA-KNOWN-EXPLOITED", value:"2022/04/18");
script_name(english:"Mozilla Thunderbird ESR 17.x < 17.0.7 Multiple Vulnerabilities");
script_set_attribute(attribute:"synopsis", value:
"The remote Windows host contains a mail client that is potentially
affected by multiple vulnerabilities.");
script_set_attribute(attribute:"description", value:
"The installed version of Thunderbird ESR 17.x is earlier than 17.0.7
and is, therefore, potentially affected the following vulnerabilities:
- Various, unspecified memory safety issues exist.
(CVE-2013-1682)
- Heap-use-after-free errors exist related to
'LookupMediaElementURITable',
'nsIDocument::GetRootElement' and 'mozilla::ResetDir'.
(CVE-2013-1684, CVE-2013-1685, CVE-2013-1686)
- An error exists related to 'XBL scope', 'System Only
Wrappers' (SOW) and chrome-privileged pages that could
allow cross-site scripting attacks. (CVE-2013-1687)
- An error related to 'onreadystatechange' and unmapped
memory could cause application crashes and allow
arbitrary code execution. (CVE-2013-1690)
- The application sends data in the body of XMLHttpRequest
(XHR) HEAD requests and could aid in cross-site request
forgery attacks. (CVE-2013-1692)
- An error related to the processing of SVG content could
allow a timing attack to disclose information across
domains. (CVE-2013-1693)
- An error exists related to 'PreserveWrapper' and the
'preserved-wrapper' flag that could cause potentially
exploitable application crashes. (CVE-2013-1694)
- An error exists related to the 'toString' and 'valueOf'
methods that could allow 'XrayWrappers' to be bypassed.
(CVE-2013-1697)");
script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2013-49/");
script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2013-50/");
script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2013-51/");
script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2013-53/");
script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2013-54/");
script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2013-55/");
script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2013-56/");
script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2013-59/");
script_set_attribute(attribute:"solution", value:
"Upgrade to Thunderbird ESR 17.0.7 or later.");
script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
script_set_cvss_temporal_vector("CVSS2#E:H/RL:OF/RC:C");
script_set_attribute(attribute:"cvss_score_source", value:"CVE-2013-1686");
script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
script_set_attribute(attribute:"exploit_available", value:"true");
script_set_attribute(attribute:"exploited_by_malware", value:"true");
script_set_attribute(attribute:"metasploit_name", value:'Firefox onreadystatechange Event DocumentViewerImpl Use After Free');
script_set_attribute(attribute:"exploit_framework_metasploit", value:"true");
script_cwe_id(20, 74, 79, 442, 629, 711, 712, 722, 725, 750, 751, 800, 801, 809, 811, 864, 900, 928, 931, 990);
script_set_attribute(attribute:"vuln_publication_date", value:"2013/06/25");
script_set_attribute(attribute:"patch_publication_date", value:"2013/06/25");
script_set_attribute(attribute:"plugin_publication_date", value:"2013/06/26");
script_set_attribute(attribute:"plugin_type", value:"local");
script_set_attribute(attribute:"cpe", value:"cpe:/a:mozilla:thunderbird");
script_end_attributes();
script_category(ACT_GATHER_INFO);
script_family(english:"Windows");
script_copyright(english:"This script is Copyright (C) 2013-2022 and is owned by Tenable, Inc. or an Affiliate thereof.");
script_dependencies("mozilla_org_installed.nasl");
script_require_keys("Mozilla/Thunderbird/Version");
exit(0);
}
include("mozilla_version.inc");
port = get_kb_item_or_exit("SMB/transport");
installs = get_kb_list("SMB/Mozilla/Thunderbird/*");
if (isnull(installs)) audit(AUDIT_NOT_INST, "Thunderbird");
mozilla_check_version(installs:installs, product:'thunderbird', esr:TRUE, fix:'17.0.7', min:'17.0', severity:SECURITY_HOLE, xss:TRUE, xsrf:TRUE);
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1682
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1684
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1685
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1686
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1687
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1690
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1692
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1693
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1694
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1697
www.mozilla.org/en-US/security/advisories/mfsa2013-49/
www.mozilla.org/en-US/security/advisories/mfsa2013-50/
www.mozilla.org/en-US/security/advisories/mfsa2013-51/
www.mozilla.org/en-US/security/advisories/mfsa2013-53/
www.mozilla.org/en-US/security/advisories/mfsa2013-54/
www.mozilla.org/en-US/security/advisories/mfsa2013-55/
www.mozilla.org/en-US/security/advisories/mfsa2013-56/
www.mozilla.org/en-US/security/advisories/mfsa2013-59/
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:L/Au:N/C:C/I:C/A:C
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS
Percentile
96.5%