Enigmail up to 2.0.6 Signature Verification Messages signature verification

Summaryinfo

A vulnerability was found in Enigmail up to 2.0.6. It has been classified as critical. Impacted is an unknown function of the component Signature Verification Handler. This manipulation as part of Messages causes signature verification. The identification of this vulnerability is CVE-2018-12019. It is possible to initiate the attack remotely. There is no exploit available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability was found in Enigmail up to 2.0.6. It has been declared as critical. Affected by this vulnerability is an unknown code block of the component Signature Verification Handler. The manipulation as part of a Messages leads to a signature verification vulnerability. The CWE definition for the vulnerability is CWE-347. The product does not verify, or incorrectly verifies, the cryptographic signature for data. As an impact it is known to affect confidentiality, and integrity. The summary by CVE is:

The signature verification routine in Enigmail before 2.0.7 interprets user ids as status/control messages and does not correctly keep track of the status of multiple signatures, which allows remote attackers to spoof arbitrary email signatures via public keys containing crafted primary user ids.

The bug was discovered 06/13/2018. The weakness was shared 06/13/2018 (Website). The advisory is shared at openwall.com. This vulnerability is known as CVE-2018-12019 since 06/07/2018. The attack can be launched remotely. The exploitation doesn't need any form of authentication. It demands that the victim is doing some kind of user interaction. Neither technical details nor an exploit are publicly available.

The vulnerability scanner Nessus provides a plugin with the ID 110674 (Fedora 27 : thunderbird-enigmail (2018-fd67c19256)), which helps to determine the existence of the flaw in a target environment. It is assigned to the family Fedora Local Security Checks and running in the context l. The commercial vulnerability scanner Qualys is able to test this issue with plugin 277349 (Fedora Security Update for thunderbird-enigmail (FEDORA-2018-a4bb79ea75)).

Upgrading to version 2.0.7 eliminates this vulnerability. A possible mitigation has been published 2 weeks after the disclosure of the vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (110674). If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Name

• Enigmail

Version

• 2.0.0
• 2.0.1
• 2.0.2
• 2.0.3
• 2.0.4
• 2.0.5
• 2.0.6

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion