Red Hat Security Advisory: thunderbird security update

1. Architecture and Design · Language Selection

   Choose a language that provides automatic memory management.

2. Implementation · Attack Surface Reduction

   When freeing pointers, be sure to set them to NULL once they are freed. However, the utilization of multiple or complex data structures may lower the usefulness of this strategy.

OWASP Cheat Sheets

• XML Security (opens in a new tab)
• Mass Assignment (opens in a new tab)

OWASP ASVS 4.0.3

• V13.3.1 (opens in a new tab)
• V5.1.4 (opens in a new tab)
• V5.1.3 (opens in a new tab)

From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

1. Architecture and Design

   Whenever possible, specify implementation strategies that do not introduce time variances in operations.

2. Implementation

   Often one can artificially manipulate the time which operations take or -- when operations occur -- can remove information from the attacker.

3. Implementation

   It is reasonable to add artificial or random delays so that the amount of CPU time consumed is independent of the action being taken by the application.

OWASP Cheat Sheets

• Cryptographic Storage (opens in a new tab)
• Key Management (opens in a new tab)

OWASP ASVS 4.0.3

• V6.2.8 (opens in a new tab)

Attack patterns

• Cross-Domain Search Timing (opens in a new tab)

From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

1. Architecture and Design · Operation

   Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.

2. Architecture and Design · Separation of Privilege

   Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area.

OWASP Cheat Sheets

• Docker Security (opens in a new tab)
• Third Party Javascript Management (opens in a new tab)
• Virtual Patching (opens in a new tab)
• Authorization (opens in a new tab)

OWASP ASVS 4.0.3

• V1.4.4 (opens in a new tab)
• V1.4.5 (opens in a new tab)
• V1.10.1 (opens in a new tab)

Attack patterns

• Embedding Scripts within Scripts (opens in a new tab)
• Modification of Windows Service Configuration (opens in a new tab)
• Malicious Root Certificate (opens in a new tab)
• Intent Spoof (opens in a new tab)
• WebView Exposure (opens in a new tab)

From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

1. Architecture and Design · Libraries or Frameworks

   Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.

2. Architecture and Design · Enforcement by Conversion

   When the set of acceptable objects, such as filenames or URLs, is limited or known, create a mapping from a set of fixed input values (such as numeric IDs) to the actual filenames or URLs, and reject all other inputs.

3. Architecture and Design

   For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks…

OWASP Cheat Sheets

• Docker Security (opens in a new tab)
• Vulnerable Dependency Management (opens in a new tab)
• Software Supply Chain Security (opens in a new tab)
• Infrastructure as Code (opens in a new tab)

OWASP ASVS 4.0.3

• V12.3.6 (opens in a new tab)
• V14.2.3 (opens in a new tab)
• V14.2.4 (opens in a new tab)

Attack patterns

• Serialized Data External Linking (opens in a new tab)
• DTD Injection (opens in a new tab)
• Local Code Inclusion (opens in a new tab)
• PHP Local File Inclusion (opens in a new tab)
• Remote Code Inclusion (opens in a new tab)

From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

1. Implementation · Input Validation

   Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.

OWASP Cheat Sheets

• XML Security (opens in a new tab)
• Mass Assignment (opens in a new tab)

OWASP ASVS 4.0.3

• V13.3.1 (opens in a new tab)
• V5.1.4 (opens in a new tab)
• V5.1.3 (opens in a new tab)

From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

1. Requirements · Language Selection

   Use a language that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.

2. Architecture and Design · Libraries or Frameworks

   Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.

3. Operation · Build and Compilation · Environment Hardening

   Use automatic buffer overflow detection mechanisms that are offered by certain compilers or compiler extensions. Examples include: the Microsoft Visual Studio /GS flag, Fedora/Red Hat FORTIFY_SOURCE GCC flag, StackGuard, and ProPolice, which provide various mechanisms including canary-based detection and range/index…

OWASP Cheat Sheets

• Docker Security (opens in a new tab)
• XML Security (opens in a new tab)

OWASP ASVS 4.0.3

• V5.4.1 (opens in a new tab)
• V14.1.2 (opens in a new tab)
• V13.3.1 (opens in a new tab)

Attack patterns

• Buffer Overflow via Environment Variables (opens in a new tab)
• Overflow Buffers (opens in a new tab)
• Client-side Injection-induced Buffer Overflow (opens in a new tab)
• Filter Failure through Buffer Overflow (opens in a new tab)
• MIME Conversion (opens in a new tab)

From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).