Red Hat Security Advisory: thunderbird security update

1. Implementation · Attack Surface Reduction

   Ensure that critical variables are initialized before first use.

2. Build and Compilation · Compilation or Build Hardening

   Most compilers will complain about the use of uninitialized variables if warnings are turned on.

3. Implementation · Operation

   When using a language that does not require explicit declaration of variables, run or compile the software in a mode that reports undeclared or unknown variables. This may indicate the presence of a typographic error in the variable's name.

From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

1. Architecture and Design

   Design strategies for ensuring safe failure if inputs, such as Vcc, are modified out of acceptable ranges.

2. Architecture and Design

   Design strategies for ensuring safe behavior if instructions attempt to be skipped.

3. Architecture and Design

   Identify mission critical secrets that should be wiped if faulting is detected, and design a mechanism to do the deletion.

Attack patterns

• Mobile Device Fault Injection (opens in a new tab)
• Hardware Fault Injection (opens in a new tab)

From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

1. Implementation

   Carefully check each input parameter against a rigorous positive specification (allowlist) defining the specific characters and format allowed. All input should be neutralized, not just parameters that the user is supposed to specify, but all data in the request, including hidden fields, cookies, headers, the URL…

2. Implementation · Output Encoding

   Use and specify an output encoding that can be handled by the downstream component that is reading the output. Common encodings include ISO-8859-1, UTF-7, and UTF-8.

3. Implementation

   With Struts, write all data from form beans with the bean's filter attribute set to true.

OWASP Cheat Sheets

• Abuse Case (opens in a new tab)
• Deserialization (opens in a new tab)
• Cross Site Scripting Prevention (opens in a new tab)
• DOM based XSS Prevention (opens in a new tab)
• Injection Prevention (opens in a new tab)

OWASP ASVS 4.0.3

• V1.5.1 (opens in a new tab)
• V5.3.3 (opens in a new tab)

Attack patterns

• XSS Targeting Non-Script Elements (opens in a new tab)
• PHP Remote File Inclusion (opens in a new tab)
• XSS Through HTTP Query Strings (opens in a new tab)
• XSS Through HTTP Headers (opens in a new tab)

From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

1. Architecture and Design · Refactoring

   Refactor your program so that you do not have to dynamically generate code.

2. Architecture and Design

   Run your code in a "jail" or similar sandbox environment that enforces strict boundaries between the process and the operating system. This may effectively restrict which code can be executed by your product.

3. Implementation · Input Validation

   Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.

OWASP Cheat Sheets

• Server Side Request Forgery Prevention (opens in a new tab)
• Unvalidated Redirects and Forwards (opens in a new tab)
• Cross Site Scripting Prevention (opens in a new tab)
• DOM based XSS Prevention (opens in a new tab)
• Abuse Case (opens in a new tab)

OWASP ASVS 4.0.3

• V5.2.8 (opens in a new tab)
• V5.2.5 (opens in a new tab)
• V1.5.1 (opens in a new tab)

Attack patterns

• Leverage Executable Code in Non-Executable Files (opens in a new tab)
• Manipulating User-Controlled Variables (opens in a new tab)
• Code Injection (opens in a new tab)

From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

1. Architecture and Design · Operation

   The architecture needs to access and modification attributes for files to only those users who actually require those actions.

2. Architecture and Design · Separation of Privilege

   Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area.

OWASP Cheat Sheets

• Access Control (opens in a new tab)
• Authorization Testing Automation (opens in a new tab)
• Authorization (opens in a new tab)

OWASP ASVS 4.0.3

• V8.3.8 (opens in a new tab)
• V13.4.2 (opens in a new tab)

Attack patterns

• Accessing Functionality Not Properly Constrained by ACLs (opens in a new tab)
• Directory Indexing (opens in a new tab)
• Web Server Logs Tampering (opens in a new tab)

From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

OWASP Cheat Sheets

• Secure Design Principles (opens in a new tab)

Attack patterns

• Accessing Functionality Not Properly Constrained by ACLs (opens in a new tab)
• Cross Site Tracing (opens in a new tab)
• Directory Indexing (opens in a new tab)
• Using Malicious Files (opens in a new tab)
• Encryption Brute Forcing (opens in a new tab)

From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

1. Implementation

   For any pointers that could have been modified or provided from a function that can return NULL, check the pointer for NULL before use. When working with a multithreaded or otherwise asynchronous environment, ensure that proper locking APIs are used to lock before the check, and unlock when it has finished.

2. Requirements

   Select a programming language that is not susceptible to these issues.

3. Implementation

   Check the results of all functions that return a value and verify that the value is non-null before acting upon it.

OWASP Cheat Sheets

• Logging (opens in a new tab)
• Error Handling (opens in a new tab)

OWASP ASVS 4.0.3

• V11.1.7 (opens in a new tab)

From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

1. Requirements · Language Selection

   Use a language that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.

2. Architecture and Design · Libraries or Frameworks

   Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.

3. Operation · Build and Compilation · Environment Hardening

   Use automatic buffer overflow detection mechanisms that are offered by certain compilers or compiler extensions. Examples include: the Microsoft Visual Studio /GS flag, Fedora/Red Hat FORTIFY_SOURCE GCC flag, StackGuard, and ProPolice, which provide various mechanisms including canary-based detection and range/index…

OWASP Cheat Sheets

• XML Security (opens in a new tab)
• Mass Assignment (opens in a new tab)

OWASP ASVS 4.0.3

• V13.3.1 (opens in a new tab)
• V5.1.4 (opens in a new tab)
• V5.1.3 (opens in a new tab)

Attack patterns

• Buffer Overflow via Environment Variables (opens in a new tab)
• Overflow Buffers (opens in a new tab)
• Client-side Injection-induced Buffer Overflow (opens in a new tab)
• Filter Failure through Buffer Overflow (opens in a new tab)
• MIME Conversion (opens in a new tab)

From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).