CVE-2005-3402 Information

Description

The SMTP client in Mozilla Thunderbird 1.0.5 BETA 1.0.7 and possibly other versions does not notify users when it cannot establish a secure channel with the server which allows remote attackers to obtain authentication information without detection via a man-in-the-middle (MITM) attack that bypasses TLS authentication or downgrades CRAM-MD5 authentication to plain authentication.

Reference

http://marc.info/?l=bugtraq&m=113028017608146&w=2 http://marc.info/?l=bugtraq&m=113034421329653&w=2 http://www.securityfocus.com/bid/15106 https://bugzilla.mozilla.org/show_bug.cgi?id=311657