Red Hat Security Advisory: thunderbird security update

1. Requirements · Language Selection

   Use a language that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.

2. Implementation

   Check the results of all functions that return a value and verify that the value is expected.

3. Implementation

   If using exception handling, catch and throw specific exceptions instead of overly-general exceptions (CWE-396, CWE-397). Catch and handle exceptions as locally as possible so that exceptions do not propagate too far up the call stack (CWE-705). Avoid unchecked or uncaught exceptions where feasible (CWE-248).

OWASP Cheat Sheets

• Logging (opens in a new tab)
• Error Handling (opens in a new tab)

OWASP ASVS 4.0.3

• V11.1.7 (opens in a new tab)

From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

1. Requirements

   Clearly specify which information should be regarded as private or sensitive, and require that the product offers functionality that allows the user to cleanse the sensitive information from the resource before it is published or exported to other parties.

2. Architecture and Design · Separation of Privilege

   Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area.

3. Implementation · Operation · Attack Surface Reduction

   Some tools can automatically analyze documents to redact, strip, or "sanitize" private information, although some human review might be necessary. Tools may vary in terms of which document formats can be processed.

OWASP ASVS 4.0.3

• V8.3.2 (opens in a new tab)

Attack patterns

• Windows ::DATA Alternate Data Stream (opens in a new tab)

From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

1. Implementation · Input Validation

   Perform data validation (e.g. syntax, length, etc.) before interpreting the data.

2. Architecture and Design · Output Encoding

   Create a strategy for presenting information, and plan for how to display unusual characters.

OWASP Cheat Sheets

• Secure Design Principles (opens in a new tab)

Attack patterns

• Spear Phishing (opens in a new tab)
• Mobile Phishing (opens in a new tab)
• Phishing (opens in a new tab)
• Resource Location Spoofing (opens in a new tab)
• Action Spoofing (opens in a new tab)

From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

1. Architecture and Design · Libraries or Frameworks

   Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.

2. Architecture and Design · Enforcement by Conversion

   When the set of acceptable objects, such as filenames or URLs, is limited or known, create a mapping from a set of fixed input values (such as numeric IDs) to the actual filenames or URLs, and reject all other inputs.

3. Architecture and Design

   For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks…

OWASP Cheat Sheets

• Docker Security (opens in a new tab)
• Vulnerable Dependency Management (opens in a new tab)
• Software Supply Chain Security (opens in a new tab)
• Infrastructure as Code (opens in a new tab)

OWASP ASVS 4.0.3

• V12.3.6 (opens in a new tab)
• V14.2.3 (opens in a new tab)
• V14.2.4 (opens in a new tab)

Attack patterns

• Serialized Data External Linking (opens in a new tab)
• DTD Injection (opens in a new tab)
• Local Code Inclusion (opens in a new tab)
• PHP Local File Inclusion (opens in a new tab)
• Remote Code Inclusion (opens in a new tab)

From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

1. Architecture and Design · Language Selection

   Choose a language that provides automatic memory management.

2. Implementation · Attack Surface Reduction

   When freeing pointers, be sure to set them to NULL once they are freed. However, the utilization of multiple or complex data structures may lower the usefulness of this strategy.

OWASP Cheat Sheets

• XML Security (opens in a new tab)
• Mass Assignment (opens in a new tab)

OWASP ASVS 4.0.3

• V13.3.1 (opens in a new tab)
• V5.1.4 (opens in a new tab)
• V5.1.3 (opens in a new tab)

From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

1. Requirements · Language Selection

   Use a language that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.

2. Architecture and Design · Libraries or Frameworks

   Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.

3. Operation · Build and Compilation · Environment Hardening

   Use automatic buffer overflow detection mechanisms that are offered by certain compilers or compiler extensions. Examples include: the Microsoft Visual Studio /GS flag, Fedora/Red Hat FORTIFY_SOURCE GCC flag, StackGuard, and ProPolice, which provide various mechanisms including canary-based detection and range/index…

OWASP Cheat Sheets

• Docker Security (opens in a new tab)
• XML Security (opens in a new tab)

OWASP ASVS 4.0.3

• V5.4.1 (opens in a new tab)
• V14.1.2 (opens in a new tab)
• V13.3.1 (opens in a new tab)

Attack patterns

• Buffer Overflow via Environment Variables (opens in a new tab)
• Overflow Buffers (opens in a new tab)
• Client-side Injection-induced Buffer Overflow (opens in a new tab)
• Filter Failure through Buffer Overflow (opens in a new tab)
• MIME Conversion (opens in a new tab)

From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).