Thunderbird 2.0.0.23 fixes SSL vulnerability
The Mozilla developers have announced the release of version 2.0.0.23 of their popular Thunderbird email client, addressing a vulnerability in the processing of SSL certificates. Previously, inserting a null character in a certificate could trick some applications into treating, for example, the certificate displayed on www.paypal.com\0.thoughtcrime.org as if it belonged to www.paypal.com.
Moxie Marlinspike and Dan Kaminsky revealed details of the vulnerability in their Black Hat presentations. The vulnerability, which also existed in Firefox 3.5.x and 3.0.x, was fixed more than two weeks ago. Other software vendors are still working on updates for their products.
The security update is recommended for all users. More details about the release can be found in the release notes. Thunderbird 2.0.0.23 is available to download for Windows, Mac OS X and Linux. Thunderbird is released under the MPL/LGPL/GPL tri-license.
See also:
- Compromise of SSL-protected communication, security advisory from the Mozilla Foundation.
- Firefox 3.5.2 and 3.0.13 fix security vulnerabilities, a report from The H.
- SSL flaw revealed at Black Hat, a report from The H.
(crve)
![Kernel Log: Coming in 3.10 (Part 3) [--] Infrastructure](/imgs/43/1/0/4/2/6/7/2/comingin310_4_kicker-4977194bfb0de0d7.png)
![Kernel Log: Coming in 3.10 (Part 3) [--] Infrastructure](/imgs/43/1/0/4/2/3/2/3/comingin310_3_kicker-151cd7b9e9660f05.png)
