Secunia Research has discovered a vulnerability in Thunderbird, which can be exploited by malicious people to trick users into executing arbitrary programs.
The vulnerability is caused due to attachments not being displayed correctly in mails. This can be exploited to spoof the file extension and the associated file type icon via a combination of overly long filenames containing whitespaces and "Content-Type" headers not matching the file extension.
Successful exploitation may lead to malware being saved to e.g. the desktop.
NOTE: Attachments can be saved by dragging the attachment, or using the "Save As..." or "Save All..." functionality. For files on the desktop, the icon can be spoofed if it e.g. is a ".exe" or ".lnk" file.
The vulnerability has been confirmed in versions 1.0.2, 1.0.6, and 1.0.7. Other versions may also be affected. Only the Microsoft Windows platform is affected.
Solution: Update to version 1.5
AOL "YGP Picture Finder Tool" ActiveX Control Buffer Overflow Vulnerability
A vulnerability has been identified in AOL software and AOL You've Got Pictures, which could be exploited by remote attackers to execute arbitrary commands. This flaw is due to a buffer overflow error in the AOL YGP Picture Finder Tool ActiveX control (YGPPicFinder.dll) that does not properly handle overly long input strings, which could be exploited by remote attackers to compromise a vulnerable system by convincing a user to visit a specially crafted web page.
AOL version 8.0
AOL version 8.0+
AOL version 9.0 Classic
Note : the vulnerable control was also distributed via the "You've Got Pictures" web site prior to 2004.
Upgrade to AOL 9.0 Optimized or AOL 9.0 Security Edition :
Or download and apply the hotfix