CVE-2005-3402: Low severity Mozilla Thunderbird vulnerability
The SMTP client in Mozilla Thunderbird 1.0.5 BETA, 1.0.7, and possibly other versions, does not notify users when it cannot establish a secure channel with the server, which allows remote attackers to obtain authentication information without detection via a man-in-the-middle (MITM) attack that bypasses TLS authentication or downgrades CRAM-MD5 authentication to plain authentication.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2005-3402?
CVE-2005-3402 is considered a moderate severity vulnerability due to the potential exposure of sensitive authentication information.
How does CVE-2005-3402 allow an attacker to exploit the vulnerability?
CVE-2005-3402 allows an attacker to exploit the vulnerability through a man-in-the-middle (MITM) attack by intercepting authentication data due to a lack of secure channel notifications.
Which versions of Mozilla Thunderbird are affected by CVE-2005-3402?
CVE-2005-3402 affects Mozilla Thunderbird versions 1.0.5 BETA and 1.0.7.
How can I mitigate the risks associated with CVE-2005-3402?
To mitigate the risks of CVE-2005-3402, users should upgrade to a later version of Mozilla Thunderbird that addresses this vulnerability.
Is there any specific user action required to trigger CVE-2005-3402?
CVE-2005-3402 can be triggered unknowingly by users when they attempt to connect to the mail server without a secure channel.