Mozilla Thunderbird Keyboard Event timing discrepancy

Summaryinfo

A vulnerability categorized as problematic has been discovered in Mozilla Thunderbird. This issue affects some unknown processing of the component Keyboard Event Handler. Executing a manipulation can lead to timing discrepancy. This vulnerability is handled as CVE-2022-45416. The attack can be executed remotely. There is not any exploit available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability has been found in Mozilla Thunderbird (Mail Client Software) (affected version unknown) and classified as problematic. This vulnerability affects an unknown functionality of the component Keyboard Event Handler. The manipulation with an unknown input leads to a timing discrepancy vulnerability. The CWE definition for the vulnerability is CWE-208. Two separate operations in a product require different amounts of time to complete, in a way that is observable to an actor and reveals security-relevant information about the state of the product, such as whether a particular operation was successful or not. As an impact it is known to affect confidentiality. CVE summarizes:

Keyboard events reference strings like "KeyA" that were at fixed, known, and widely-spread addresses. Cache-based timing attacks such as Prime+Probe could have possibly figured out which keys were being pressed. This vulnerability affects Firefox ESR < 102.5, Thunderbird < 102.5, and Firefox < 107.

The weakness was released 12/23/2022. The advisory is shared for download at mozilla.org. This vulnerability was named CVE-2022-45416 since 11/14/2022. Successful exploitation requires user interaction by the victim. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1592.

The vulnerability scanner Nessus provides a plugin with the ID 249965 (Linux Distros Unpatched Vulnerability : CVE-2022-45416), which helps to determine the existence of the flaw in a target environment.

Upgrading eliminates this vulnerability. The upgrade is hosted for download at mozilla.org.

The vulnerability is also documented in the vulnerability database at Tenable (249965). VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Mail Client Software

Vendor

• Mozilla

Name

• Thunderbird

License

• open-source

Website

• Vendor: https://www.mozilla.org/

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion