Vulnerabilities > CVE-2007-1264 - Unspecified vulnerability in Enigmail

CVSS 5.0 - MEDIUM

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

NONE

Integrity impact

PARTIAL

Availability impact

NONE

network

low complexity

enigmail

nessus

exploit available

NVD

Published: 2007-03-06

Updated: 2018-10-16

Summary

Enigmail 0.94.2 and earlier does not properly use the --status-fd argument when invoking GnuPG, which prevents Enigmail from visually distinguishing between signed and unsigned portions of OpenPGP messages with multiple components, which allows remote attackers to forge the contents of a message without detection.

Vulnerable Configurations

Part	Description	Count
Application	Enigmail Enigmail Enigmail 0.74.0 Enigmail Enigmail 0.74.1 Enigmail Enigmail 0.75.0 Enigmail Enigmail 0.76.0 Enigmail Enigmail 0.76.1 Enigmail Enigmail 0.76.2 Enigmail Enigmail 0.76.3 Enigmail Enigmail 0.76.4 Enigmail Enigmail 0.76.7 Enigmail Enigmail 0.76.8 Enigmail Enigmail 0.80.0 Enigmail Enigmail 0.81.2 Enigmail Enigmail 0.81.5 Enigmail Enigmail 0.81.6 Enigmail Enigmail 0.81.7 Enigmail Enigmail 0.82.0 Enigmail Enigmail 0.82.1 Enigmail Enigmail 0.82.2 Enigmail Enigmail 0.82.3 Enigmail Enigmail 0.82.4 Enigmail Enigmail 0.82.5 Enigmail Enigmail 0.82.6 Enigmail Enigmail 0.83.0 Enigmail Enigmail 0.83.1 Enigmail Enigmail 0.83.2 Enigmail Enigmail 0.83.3 Enigmail Enigmail 0.83.4 Enigmail Enigmail 0.83.5 Enigmail Enigmail 0.83.6 Enigmail Enigmail 0.84.0 Enigmail Enigmail 0.84.1 Enigmail Enigmail 0.84.2 Enigmail Enigmail 0.85.0 Enigmail Enigmail 0.86.0 Enigmail Enigmail 0.86.1 Enigmail Enigmail 0.89.0 Enigmail Enigmail 0.89.1 Enigmail Enigmail 0.89.2 Enigmail Enigmail 0.89.3 Enigmail Enigmail 0.89.4 Enigmail Enigmail 0.89.5 Enigmail Enigmail 0.89.6 Enigmail Enigmail 0.90.0 Enigmail Enigmail 0.90.1 Enigmail Enigmail 0.90.2 Enigmail Enigmail 0.91.0 Enigmail Enigmail 0.92.0 Enigmail Enigmail 0.92.1 Enigmail Enigmail 0.93.0 Enigmail Enigmail 0.93.1 Enigmail Enigmail 0.93.2 Enigmail Enigmail 0.94.0 Enigmail Enigmail 0.94.1 Enigmail Enigmail 0.94.2	54

Exploit-Db

description	KMail 1.x GnuPG Arbitrary Content Injection Vulnerability. CVE-2007-1264. Remote exploit for linux platform
id	EDB-ID:29690
last seen	2016-02-03
modified	2007-03-05
published	2007-03-05
reporter	Gerardo Richarte
source	https://www.exploit-db.com/download/29690/
title	KMail 1.x GnuPG Arbitrary Content Injection Vulnerability

Nessus

NASL family	Ubuntu Local Security Checks
NASL id	UBUNTU_USN-432-1.NASL
description	Gerardo Richarte from Core Security Technologies discovered that when gnupg is used without --status-fd, there is no way to distinguish initial unsigned messages from a following signed message. An attacker could inject an unsigned message, which could fool the user into thinking the message was entirely signed by the original sender. Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
last seen	2020-06-01
modified	2020-06-02
plugin id	28026
published	2007-11-10
reporter	Ubuntu Security Notice (C) 2007-2019 Canonical, Inc. / NASL script (C) 2018 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/28026
title	Ubuntu 5.10 / 6.06 LTS / 6.10 : gnupg vulnerability (USN-432-1)

NASL family	Mandriva Local Security Checks
NASL id	MANDRAKE_MDKSA-2007-059.NASL
description	GnuPG prior to 1.4.7 and GPGME prior to 1.1.4, when run from the command line, did not visually distinguish signed and unsigned portions of OpenPGP messages with multiple components. This could allow a remote attacker to forge the contents of an email message without detection. GnuPG 1.4.7 is being provided with this update and GPGME has been patched on Mandriva 2007.0 to provide better visual notification on these types of forgeries.
last seen	2020-06-01
modified	2020-06-02
plugin id	24809
published	2007-03-12
reporter	This script is Copyright (C) 2007-2019 Tenable Network Security, Inc.
source	https://www.tenable.com/plugins/nessus/24809
title	Mandrake Linux Security Advisory : gnupg (MDKSA-2007:059)

Summary

Vulnerable Configurations

Exploit-Db

Nessus

References