Thunderbird Installed (Mac OS X)

#TRUSTED 6498bc5791145ad9035744d3bc8722ab6945cc9dddab60470d03b4040c842f9f7eca9a5c242e9c45048947090b1f7c85265f4be716237bc70f13cc64ab2efb4491e31b9ca2a39a935bd235f0a207d581a30b33334de931b7a940021618520d18beb170ab64bf83364d831e7a547c22ef84a5edb211fd0798f392253dc422932d24aaea1e35e004d7f860a6d11e704840340dd8662f872c4de5f2b9bbf74921f7c909fe5425b08ed6f6fbbe998c67a84acfcbb692cafa124142d73ad91be3e227aa72d3dc4bb9ec1697a2f134b7723889a0c2a9e28be68602710a25352458352f1d9ab773b41838d2dbf48424337c878b9b902dfccdb12e6bdc4b619ac6958c6c6159872eca8ff9d973bdfeb367dab83de6f67333ac149d10f541bd464e38f7fd75dc5775ce9d15c508146438b891ee8709456867ac5cd6af7b67d07a04999c7ea3ea24ef9c1908691b050a740d0d2c8a031b0e7f75845aeb37b4a2c76449ebf7060773f09382da1598e01e848dc9594c36d0a3eda1906af71bdef4da6bcbd6ebc705a4c9c601fa26852a2fb3c261408c9dcb2b4cf22213380e302aa2616cdcb493529d599cee00490d1a5f9fd3492f891523c9fb6aa416adfac2a744af88c7a7bf47efb4af3781e01e589043af2d3c36c60b760c1de38a1ba2f91c345b4377ea16f21cc00fa44deffcd15e92c815535c751035d8e6df2d847e91ddb0a0f13e53
#TRUST-RSA-SHA256 9cb12d628f68462d307b55c58a5242deb84a19e6c30cbd927b592ba9d5d0dc83ce7b74761f202f30c38a6bea247dafcf0c24c731892250cff2e08567f479206a8cb52730c99169686855a2c6d565229371b62b284e255856e40d7c451fa81c301522d6c81b59cadf6cb6241e435ee14882f111d253acc767a5fd2598427faf154fcb898faf0a2bf8d747637717421abde3a7852de56c6bd08c9f8cd5c897fde485000de9d5a53c2602e84a2f2ce573ef37ca0b064e6c0bad1ffa6955fccf7cf5f405c1a53469ed761b6ee037c4a3ac571058ee8090b3a6523ae889851469bb887a5ca84583cc0206c6767b52503223067c552ccff4d63a26aef71907dce0a4386f5312f62ef6930b190b25cb10f87c5cb75415a8a2265f6a46145425c6db3a4c2c03c543514477a954c5c25aa7d7f0c7e0a9a1b0e0ff7b55ee149c763467c25802227bbf0f65f437fc90ef2f95f13b598e7fe4003faa69bc291973daafd32274f1670e2b32e3fb3d9800288dc9c55de5fd7814141b35483af927ce43671448be24f9c55d574aafa04248977729fbbe478509b0e6d8f8870b30b35ba1763700db3595ebbec82fe99a40b5ccd90ab99d6bb7466226f63e6fa18d3bab3b45514ec2ca3fa4832234f4845c4b7ac35cff043a2eb2e35e3a73a6c37500399ff8a8386c8a6cff61191e5c85d3fd62da8bbf27d15926a3d2229113bdb5468d53288dbac7
#
# (C) Tenable Network Security, Inc.
#

include("compat.inc");

if (description)
{
  script_id(56557);
  script_version("1.31");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/05/06");

  script_xref(name:"IAVT", value:"0001-T-0730");

  script_name(english:"Thunderbird Installed (Mac OS X)");

  script_set_attribute(attribute:"synopsis", value:
"The remote Mac OS X host contains an alternative email client.");
  script_set_attribute(attribute:"description", value:
"Mozilla Thunderbird is installed on the remote Mac OS X host.");
  script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/thunderbird/");
  script_set_attribute(attribute:"solution", value:"n/a");
  script_set_attribute(attribute:"risk_factor", value:"None");

  script_set_attribute(attribute:"plugin_publication_date", value:"2011/10/19");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:mozilla:thunderbird");
  script_set_attribute(attribute:"asset_inventory", value:"True");
  script_set_attribute(attribute:"asset_inventory_category", value:"software_enumeration");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"MacOS X Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2011-2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/MacOSX/Version");

  exit(0);
}

include("ssh_func.inc");
include("macosx_func.inc");
include("install_func.inc");

var app = "Mozilla Thunderbird";

if(sshlib::get_support_level() >= sshlib::SSH_LIB_SUPPORTS_COMMANDS ||
    get_one_kb_item('HostLevelChecks/proto') == 'local')
  enable_ssh_wrappers();
else disable_ssh_wrappers();

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);

var os = get_kb_item("Host/MacOSX/Version");
if (!os) audit(AUDIT_OS_NOT, "Mac OS X");


var kb_base = "MacOSX/Thunderbird";

var path = '/Applications/Thunderbird.app';
var plist = path + '/Contents/Info.plist';
var cmd =  'plutil -convert xml1 -o - \'' + plist + '\' 2>/dev/null | ' +
  'grep -A 1 CFBundleShortVersionString | ' +
  'tail -n 1 | ' +
  'sed \'s/.*string>\\(.*\\)<\\/string>.*/\\1/g\'';
var version = exec_cmd(cmd:cmd);
if (!strlen(version)) audit(AUDIT_NOT_INST, app);

set_kb_item(name:kb_base+"/Installed", value:TRUE);

if (version !~ "^[0-9]") audit(AUDIT_VER_FAIL, app);
set_kb_item(name:kb_base+"/Version", value:version);

# Set path here so if, in the future, locations
# change on Mac, we can detect and use this variable
# and KB item in version checks.
set_kb_item(name:kb_base+"/Path", value:path);
var orig_version = version;

# Check if ESR
var sw_edition = NULL;
var esr_major_versions_pattern = "^(10\.|17\.|115\.|128\.|140\.)";
var cpe = "cpe:/a:mozilla:thunderbird";
if (version =~ esr_major_versions_pattern)
{
  var xul_file = path + '/Contents/MacOS/XUL';
  cmd = 'grep -ie "esr.releasechannel" '+xul_file;
  var is_esr_res = exec_cmd(cmd:cmd);

  if (is_esr_res =~ "^Binary file.*\/XUL matches")
  {
    var is_esr = " ESR";
    set_kb_item(name:kb_base+"/is_esr", value:TRUE);
    version += " ESR";
    sw_edition = 'ESR';
    cpe += "_esr";
  }
  else
  {
    info_connect(exit_on_fail:true);
    var path_to_esr = ldnix::append_path(path:path, value:'/Contents/Resources/application.ini');
    if (ldnix::file_exists(file:path_to_esr))
    {
      var contents = ldnix::get_file_contents(file:path_to_esr);

      var esr_matches = pregmatch(string:contents, pattern:"RemotingName=thunderbird-esr");
      if (!isnull(esr_matches))
      {
        is_esr = " ESR";
        set_kb_item(name:kb_base+"/is_esr", value:TRUE);
        version += " ESR";
        sw_edition = 'ESR';
        cpe += "_esr";
      }
    }
  }
  
}
#ESR flag is not included in app name, as ESR use was depricated, all versions are now considered part of the main branch for SEOL consideration where this is used.
register_install(
  app_name:app, 
  vendor : 'Mozilla',
  product : 'Thunderbird',
  sw_edition : sw_edition,
  path:path,
  version:orig_version,
  cpe:cpe
);

report_installs(app_name:app + is_esr);