Some time ago we spoke about a VCard parsing vulnerability in Windows Exchange Servers. This threat was classified as high risk and we monitored for abnormal activities but never detected any targeted attacks.
We recently discovered a small surprise, a similar VCard handling vulnerability was found in Thunderbird (the Mozilla e-mail client).
Masatoshi Kimura reported a hang caused by a double-free in Thunderbird when processing a large VCard with invalid base64 characters in it. Since an attacker can supply an arbitrary amount of well-formed VCard data before introducing the error we presume this could be exploited to run code of the attacker’s choosing.
[source: MFSA 2006-40]
This shows again how the discovery of a vulnerability in one product can lead to similar discovery in a different product.
When a vulnerability is released, it is common for developers using the same definitions (protocol/file specifications), as defined by RFC’s, to check their code for similar errors.
Due to the fact the a proof of concept for the original vulnerability was never divulged, we know that other developers did not know where to begin testing their source code for the same bug.
This has resulted in the creation of non-source based software techniques, like the fuzzing technique, which automates tests on applications by passing them various types of input.