Vulnerabilities > CVE-2018-15587 - Improper Verification of Cryptographic Signature vulnerability in multiple products

047910
CVSS 6.5 - MEDIUM
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
NONE
Integrity impact
HIGH
Availability impact
NONE
network
low complexity
gnome
debian
CWE-347
nessus
NVD
Published: 2019-02-11
Updated: 2019-06-10

Summary

GNOME Evolution through 3.28.2 is prone to OpenPGP signatures being spoofed for arbitrary messages using a specially crafted email that contains a valid signature from the entity to be impersonated as an attachment.

Vulnerable Configurations

Part Description Count
Application
Gnome
404
OS
Debian
1

Common Weakness Enumeration (CWE)

Common Attack Pattern Enumeration and Classification (CAPEC)

  • Padding Oracle Crypto Attack
    An attacker is able to efficiently decrypt data without knowing the decryption key if a target system leaks data on whether or not a padding error happened while decrypting the ciphertext. A target system that leaks this type of information becomes the padding oracle and an attacker is able to make use of that oracle to efficiently decrypt data without knowing the decryption key by issuing on average 128*b calls to the padding oracle (where b is the number of bytes in the ciphertext block). In addition to performing decryption, an attacker is also able to produce valid ciphertexts (i.e., perform encryption) by using the padding oracle, all without knowing the encryption key. Any cryptosystem can be vulnerable to padding oracle attacks if the encrypted messages are not authenticated to ensure their validity prior to decryption, and then the information about padding error is leaked to the attacker. This attack technique may be used, for instance, to break CAPTCHA systems or decrypt/modify state information stored in client side objects (e.g., hidden fields or cookies). This attack technique is a side-channel attack on the cryptosystem that uses a data leak from an improperly implemented decryption routine to completely subvert the cryptosystem. The one bit of information that tells the attacker whether a padding error during decryption has occurred, in whatever form it comes, is sufficient for the attacker to break the cryptosystem. That bit of information can come in a form of an explicit error message about a padding error, a returned blank page, or even the server taking longer to respond (a timing attack). This attack can be launched cross domain where an attacker is able to use cross-domain information leaks to get the bits of information from the padding oracle from a target system / service with which the victim is communicating. To do so an attacker sends a request containing ciphertext to the target system. Due to the browser's same origin policy, the attacker is not able to see the response directly, but can use cross-domain information leak techniques to still get the information needed (i.e., information on whether or not a padding error has occurred). For instance, this can be done using "img" tag plus the onerror()/onload() events. The attacker's JavaScript can make web browsers to load an image on the target site, and know if the image is loaded or not. This is 1-bit information needed for the padding oracle attack to work: if the image is loaded, then it is valid padding, otherwise it is not.

Nessus

  • NASL familySuSE Local Security Checks
    NASL idOPENSUSE-2019-1431.NASL
    descriptionThis update for evolution fixes the following issues : Security issue fixed : - CVE-2018-15587: Fixed an issue with spoofed pgp signatures by using specially crafted emails (bsc#1125230). This update was imported from the SUSE:SLE-15:Update update project.
    last seen2020-06-01
    modified2020-06-02
    plugin id125330
    published2019-05-22
    reporterThis script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/125330
    titleopenSUSE Security Update : evolution (openSUSE-2019-1431)
    code
    #
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from openSUSE Security Update openSUSE-2019-1431.
#
# The text description of this plugin is (C) SUSE LLC.
#

include("compat.inc");

if (description)
{
  script_id(125330);
  script_version("1.2");
  script_cvs_date("Date: 2019/05/29 10:47:07");

  script_cve_id("CVE-2018-15587");

  script_name(english:"openSUSE Security Update : evolution (openSUSE-2019-1431)");
  script_summary(english:"Check for the openSUSE-2019-1431 patch");

  script_set_attribute(
    attribute:"synopsis", 
    value:"The remote openSUSE host is missing a security update."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"This update for evolution fixes the following issues :

Security issue fixed :

  - CVE-2018-15587: Fixed an issue with spoofed pgp
    signatures by using specially crafted emails
    (bsc#1125230).

This update was imported from the SUSE:SLE-15:Update update project."
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1125230"
  );
  script_set_attribute(
    attribute:"solution", 
    value:"Update the affected evolution packages."
  );
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:evolution");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:evolution-debuginfo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:evolution-debugsource");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:evolution-devel");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:evolution-lang");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:evolution-plugin-bogofilter");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:evolution-plugin-bogofilter-debuginfo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:evolution-plugin-pst-import");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:evolution-plugin-pst-import-debuginfo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:evolution-plugin-spamassassin");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:evolution-plugin-spamassassin-debuginfo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:glade-catalog-evolution");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:glade-catalog-evolution-debuginfo");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:opensuse:15.1");

  script_set_attribute(attribute:"vuln_publication_date", value:"2019/02/11");
  script_set_attribute(attribute:"patch_publication_date", value:"2019/05/21");
  script_set_attribute(attribute:"plugin_publication_date", value:"2019/05/22");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
  script_family(english:"SuSE Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/SuSE/release", "Host/SuSE/rpm-list", "Host/cpu");

  exit(0);
}


include("audit.inc");
include("global_settings.inc");
include("rpm.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
release = get_kb_item("Host/SuSE/release");
if (isnull(release) || release =~ "^(SLED|SLES)") audit(AUDIT_OS_NOT, "openSUSE");
if (release !~ "^(SUSE15\.1)$") audit(AUDIT_OS_RELEASE_NOT, "openSUSE", "15.1", release);
if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

ourarch = get_kb_item("Host/cpu");
if (!ourarch) audit(AUDIT_UNKNOWN_ARCH);
if (ourarch !~ "^(x86_64)$") audit(AUDIT_ARCH_NOT, "x86_64", ourarch);

flag = 0;

if ( rpm_check(release:"SUSE15.1", reference:"evolution-3.26.6-lp151.4.3.1") ) flag++;
if ( rpm_check(release:"SUSE15.1", reference:"evolution-debuginfo-3.26.6-lp151.4.3.1") ) flag++;
if ( rpm_check(release:"SUSE15.1", reference:"evolution-debugsource-3.26.6-lp151.4.3.1") ) flag++;
if ( rpm_check(release:"SUSE15.1", reference:"evolution-devel-3.26.6-lp151.4.3.1") ) flag++;
if ( rpm_check(release:"SUSE15.1", reference:"evolution-lang-3.26.6-lp151.4.3.1") ) flag++;
if ( rpm_check(release:"SUSE15.1", reference:"evolution-plugin-bogofilter-3.26.6-lp151.4.3.1") ) flag++;
if ( rpm_check(release:"SUSE15.1", reference:"evolution-plugin-bogofilter-debuginfo-3.26.6-lp151.4.3.1") ) flag++;
if ( rpm_check(release:"SUSE15.1", reference:"evolution-plugin-pst-import-3.26.6-lp151.4.3.1") ) flag++;
if ( rpm_check(release:"SUSE15.1", reference:"evolution-plugin-pst-import-debuginfo-3.26.6-lp151.4.3.1") ) flag++;
if ( rpm_check(release:"SUSE15.1", reference:"evolution-plugin-spamassassin-3.26.6-lp151.4.3.1") ) flag++;
if ( rpm_check(release:"SUSE15.1", reference:"evolution-plugin-spamassassin-debuginfo-3.26.6-lp151.4.3.1") ) flag++;
if ( rpm_check(release:"SUSE15.1", reference:"glade-catalog-evolution-3.26.6-lp151.4.3.1") ) flag++;
if ( rpm_check(release:"SUSE15.1", reference:"glade-catalog-evolution-debuginfo-3.26.6-lp151.4.3.1") ) flag++;

if (flag)
{
  if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());
  else security_warning(0);
  exit(0);
}
else
{
  tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "evolution / evolution-debuginfo / evolution-debugsource / etc");
}
  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2019-FC866E9156.NASL
    descriptionSecurity fix for CVE-2018-15587 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id122728
    published2019-03-11
    reporterThis script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/122728
    titleFedora 28 : evolution (2019-fc866e9156)
    code
    #
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were  
# extracted from Fedora Security Advisory FEDORA-2019-fc866e9156.
#

include("compat.inc");

if (description)
{
  script_id(122728);
  script_version("1.3");
  script_cvs_date("Date: 2019/09/23 11:21:12");

  script_cve_id("CVE-2018-15587");
  script_xref(name:"FEDORA", value:"2019-fc866e9156");

  script_name(english:"Fedora 28 : evolution (2019-fc866e9156)");
  script_summary(english:"Checks rpm output for the updated package.");

  script_set_attribute(
    attribute:"synopsis", 
    value:"The remote Fedora host is missing a security update."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"Security fix for CVE-2018-15587

Note that Tenable Network Security has extracted the preceding
description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as
possible without introducing additional issues."
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bodhi.fedoraproject.org/updates/FEDORA-2019-fc866e9156"
  );
  script_set_attribute(
    attribute:"solution", 
    value:"Update the affected evolution package."
  );
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fedoraproject:fedora:evolution");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:fedoraproject:fedora:28");

  script_set_attribute(attribute:"vuln_publication_date", value:"2019/02/11");
  script_set_attribute(attribute:"patch_publication_date", value:"2019/03/08");
  script_set_attribute(attribute:"plugin_publication_date", value:"2019/03/11");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
  script_family(english:"Fedora Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list");

  exit(0);
}


include("audit.inc");
include("global_settings.inc");
include("rpm.inc");


if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
release = get_kb_item("Host/RedHat/release");
if (isnull(release) || "Fedora" >!< release) audit(AUDIT_OS_NOT, "Fedora");
os_ver = pregmatch(pattern: "Fedora.*release ([0-9]+)", string:release);
if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Fedora");
os_ver = os_ver[1];
if (! preg(pattern:"^28([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Fedora 28", "Fedora " + os_ver);

if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);


cpu = get_kb_item("Host/cpu");
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Fedora", cpu);


flag = 0;
if (rpm_check(release:"FC28", reference:"evolution-3.28.5-3.fc28")) flag++;


if (flag)
{
  security_report_v4(
    port       : 0,
    severity   : SECURITY_WARNING,
    extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "evolution");
}
  • NASL familySuSE Local Security Checks
    NASL idOPENSUSE-2019-1528.NASL
    descriptionThis update for evolution fixes the following issue : Security issue fixed : - CVE-2018-15587: Fixed OpenPGP signatures spoofing via specially crafted email that contains a valid signature (bsc#1125230). This update was imported from the SUSE:SLE-12-SP3:Update update project.
    last seen2020-06-01
    modified2020-06-02
    plugin id125795
    published2019-06-10
    reporterThis script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/125795
    titleopenSUSE Security Update : evolution (openSUSE-2019-1528)
    code
    #
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from openSUSE Security Update openSUSE-2019-1528.
#
# The text description of this plugin is (C) SUSE LLC.
#

include("compat.inc");

if (description)
{
  script_id(125795);
  script_version("1.2");
  script_cvs_date("Date: 2019/06/12 10:41:31");

  script_cve_id("CVE-2018-15587");

  script_name(english:"openSUSE Security Update : evolution (openSUSE-2019-1528)");
  script_summary(english:"Check for the openSUSE-2019-1528 patch");

  script_set_attribute(
    attribute:"synopsis", 
    value:"The remote openSUSE host is missing a security update."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"This update for evolution fixes the following issue :

Security issue fixed :

  - CVE-2018-15587: Fixed OpenPGP signatures spoofing via
    specially crafted email that contains a valid signature
    (bsc#1125230).

This update was imported from the SUSE:SLE-12-SP3:Update update
project."
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1125230"
  );
  script_set_attribute(
    attribute:"solution", 
    value:"Update the affected evolution packages."
  );
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:evolution");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:evolution-debuginfo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:evolution-debugsource");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:evolution-devel");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:evolution-lang");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:evolution-plugin-bogofilter");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:evolution-plugin-bogofilter-debuginfo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:evolution-plugin-pst-import");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:evolution-plugin-pst-import-debuginfo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:evolution-plugin-spamassassin");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:evolution-plugin-spamassassin-debuginfo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:glade-catalog-evolution");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:glade-catalog-evolution-debuginfo");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:opensuse:42.3");

  script_set_attribute(attribute:"vuln_publication_date", value:"2019/02/11");
  script_set_attribute(attribute:"patch_publication_date", value:"2019/06/07");
  script_set_attribute(attribute:"plugin_publication_date", value:"2019/06/10");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
  script_family(english:"SuSE Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/SuSE/release", "Host/SuSE/rpm-list", "Host/cpu");

  exit(0);
}


include("audit.inc");
include("global_settings.inc");
include("rpm.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
release = get_kb_item("Host/SuSE/release");
if (isnull(release) || release =~ "^(SLED|SLES)") audit(AUDIT_OS_NOT, "openSUSE");
if (release !~ "^(SUSE42\.3)$") audit(AUDIT_OS_RELEASE_NOT, "openSUSE", "42.3", release);
if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

ourarch = get_kb_item("Host/cpu");
if (!ourarch) audit(AUDIT_UNKNOWN_ARCH);
if (ourarch !~ "^(x86_64)$") audit(AUDIT_ARCH_NOT, "x86_64", ourarch);

flag = 0;

if ( rpm_check(release:"SUSE42.3", reference:"evolution-3.22.6-5.9.1") ) flag++;
if ( rpm_check(release:"SUSE42.3", reference:"evolution-debuginfo-3.22.6-5.9.1") ) flag++;
if ( rpm_check(release:"SUSE42.3", reference:"evolution-debugsource-3.22.6-5.9.1") ) flag++;
if ( rpm_check(release:"SUSE42.3", reference:"evolution-devel-3.22.6-5.9.1") ) flag++;
if ( rpm_check(release:"SUSE42.3", reference:"evolution-lang-3.22.6-5.9.1") ) flag++;
if ( rpm_check(release:"SUSE42.3", reference:"evolution-plugin-bogofilter-3.22.6-5.9.1") ) flag++;
if ( rpm_check(release:"SUSE42.3", reference:"evolution-plugin-bogofilter-debuginfo-3.22.6-5.9.1") ) flag++;
if ( rpm_check(release:"SUSE42.3", reference:"evolution-plugin-pst-import-3.22.6-5.9.1") ) flag++;
if ( rpm_check(release:"SUSE42.3", reference:"evolution-plugin-pst-import-debuginfo-3.22.6-5.9.1") ) flag++;
if ( rpm_check(release:"SUSE42.3", reference:"evolution-plugin-spamassassin-3.22.6-5.9.1") ) flag++;
if ( rpm_check(release:"SUSE42.3", reference:"evolution-plugin-spamassassin-debuginfo-3.22.6-5.9.1") ) flag++;
if ( rpm_check(release:"SUSE42.3", reference:"glade-catalog-evolution-3.22.6-5.9.1") ) flag++;
if ( rpm_check(release:"SUSE42.3", reference:"glade-catalog-evolution-debuginfo-3.22.6-5.9.1") ) flag++;

if (flag)
{
  if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());
  else security_warning(0);
  exit(0);
}
else
{
  tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "evolution / evolution-debuginfo / evolution-debugsource / etc");
}
  • NASL familySuSE Local Security Checks
    NASL idSUSE_SU-2019-1391-1.NASL
    descriptionThis update for evolution fixes the following issue : Security issue fixed : CVE-2018-15587: Fixed OpenPGP signatures spoofing via specially crafted email that contains a valid signature (bsc#1125230). Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id125675
    published2019-06-03
    reporterThis script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/125675
    titleSUSE SLED12 Security Update : evolution (SUSE-SU-2019:1391-1)
    code
    #
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from SUSE update advisory SUSE-SU-2019:1391-1.
# The text itself is copyright (C) SUSE.
#

include("compat.inc");

if (description)
{
  script_id(125675);
  script_version("1.3");
  script_cvs_date("Date: 2019/09/10 13:51:51");

  script_cve_id("CVE-2018-15587");

  script_name(english:"SUSE SLED12 Security Update : evolution (SUSE-SU-2019:1391-1)");
  script_summary(english:"Checks rpm output for the updated packages.");

  script_set_attribute(
    attribute:"synopsis", 
    value:"The remote SUSE host is missing one or more security updates."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"This update for evolution fixes the following issue :

Security issue fixed :

CVE-2018-15587: Fixed OpenPGP signatures spoofing via specially
crafted email that contains a valid signature (bsc#1125230).

Note that Tenable Network Security has extracted the preceding
description block directly from the SUSE security advisory. Tenable
has attempted to automatically clean and format it as much as possible
without introducing additional issues."
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.suse.com/show_bug.cgi?id=1125230"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://www.suse.com/security/cve/CVE-2018-15587/"
  );
  # https://www.suse.com/support/update/announcement/2019/suse-su-20191391-1/
  script_set_attribute(
    attribute:"see_also",
    value:"http://www.nessus.org/u?82cd60df"
  );
  script_set_attribute(
    attribute:"solution", 
    value:
"To install this SUSE Security Update use the SUSE recommended
installation methods like YaST online_update or 'zypper patch'.

Alternatively you can run the command listed for your product :

SUSE Linux Enterprise Workstation Extension 12-SP4:zypper in -t patch
SUSE-SLE-WE-12-SP4-2019-1391=1

SUSE Linux Enterprise Workstation Extension 12-SP3:zypper in -t patch
SUSE-SLE-WE-12-SP3-2019-1391=1

SUSE Linux Enterprise Software Development Kit 12-SP4:zypper in -t
patch SUSE-SLE-SDK-12-SP4-2019-1391=1

SUSE Linux Enterprise Software Development Kit 12-SP3:zypper in -t
patch SUSE-SLE-SDK-12-SP3-2019-1391=1

SUSE Linux Enterprise Desktop 12-SP4:zypper in -t patch
SUSE-SLE-DESKTOP-12-SP4-2019-1391=1

SUSE Linux Enterprise Desktop 12-SP3:zypper in -t patch
SUSE-SLE-DESKTOP-12-SP3-2019-1391=1"
  );
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:evolution");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:evolution-debuginfo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:evolution-debugsource");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:suse_linux:12");

  script_set_attribute(attribute:"vuln_publication_date", value:"2019/02/11");
  script_set_attribute(attribute:"patch_publication_date", value:"2019/05/31");
  script_set_attribute(attribute:"plugin_publication_date", value:"2019/06/03");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
  script_family(english:"SuSE Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/SuSE/release", "Host/SuSE/rpm-list");

  exit(0);
}


include("audit.inc");
include("global_settings.inc");
include("rpm.inc");


if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
release = get_kb_item("Host/SuSE/release");
if (isnull(release) || release !~ "^(SLED|SLES)") audit(AUDIT_OS_NOT, "SUSE");
os_ver = pregmatch(pattern: "^(SLE(S|D)\d+)", string:release);
if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "SUSE");
os_ver = os_ver[1];
if (! preg(pattern:"^(SLED12)$", string:os_ver)) audit(AUDIT_OS_NOT, "SUSE SLED12", "SUSE " + os_ver);

if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

cpu = get_kb_item("Host/cpu");
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if (cpu !~ "^i[3-6]86$" && "x86_64" >!< cpu && "s390x" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "SUSE " + os_ver, cpu);
if (cpu >!< "x86_64") audit(AUDIT_ARCH_NOT, "x86_64", cpu);


sp = get_kb_item("Host/SuSE/patchlevel");
if (isnull(sp)) sp = "0";
if (os_ver == "SLED12" && (! preg(pattern:"^(3|4)$", string:sp))) audit(AUDIT_OS_NOT, "SLED12 SP3/4", os_ver + " SP" + sp);


flag = 0;
if (rpm_check(release:"SLED12", sp:"4", cpu:"x86_64", reference:"evolution-3.22.6-19.9.1")) flag++;
if (rpm_check(release:"SLED12", sp:"4", cpu:"x86_64", reference:"evolution-debuginfo-3.22.6-19.9.1")) flag++;
if (rpm_check(release:"SLED12", sp:"4", cpu:"x86_64", reference:"evolution-debugsource-3.22.6-19.9.1")) flag++;
if (rpm_check(release:"SLED12", sp:"3", cpu:"x86_64", reference:"evolution-3.22.6-19.9.1")) flag++;
if (rpm_check(release:"SLED12", sp:"3", cpu:"x86_64", reference:"evolution-debuginfo-3.22.6-19.9.1")) flag++;
if (rpm_check(release:"SLED12", sp:"3", cpu:"x86_64", reference:"evolution-debugsource-3.22.6-19.9.1")) flag++;


if (flag)
{
  if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());
  else security_warning(0);
  exit(0);
}
else
{
  tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "evolution");
}
  • NASL familyRed Hat Local Security Checks
    NASL idREDHAT-RHSA-2020-1080.NASL
    descriptionThe remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:1080 advisory. - evolution: specially crafted email leading to OpenPGP signatures being spoofed for arbitrary messages (CVE-2018-15587) - evolution-ews: all certificate errors ignored if error is ignored during initial account setup in gnome-online- accounts (CVE-2019-3890) Note that Nessus has not tested for this issue but has instead relied only on the application
    last seen2020-04-23
    modified2020-04-01
    plugin id135047
    published2020-04-01
    reporterThis script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/135047
    titleRHEL 7 : evolution (RHSA-2020:1080)
    code
    #
# (C) Tenable Network Security, Inc.
#

# The descriptive text and package checks in this plugin were
# extracted from Red Hat Security Advisory RHSA-2020:1080. The text
# itself is copyright (C) Red Hat, Inc.
#


include('compat.inc');

if (description)
{
  script_id(135047);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2020/04/21");

  script_cve_id("CVE-2018-15587", "CVE-2019-3890");
  script_bugtraq_id(107164);
  script_xref(name:"RHSA", value:"2020:1080");

  script_name(english:"RHEL 7 : evolution (RHSA-2020:1080)");
  script_summary(english:"Checks the rpm output for the updated packages");

  script_set_attribute(attribute:"synopsis", value:
"The remote Red Hat host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as
referenced in the RHSA-2020:1080 advisory.

  - evolution: specially crafted email leading to OpenPGP
    signatures being spoofed for arbitrary messages
    (CVE-2018-15587)

  - evolution-ews: all certificate errors ignored if error
    is ignored during initial account setup in gnome-online-
    accounts (CVE-2019-3890)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://cwe.mitre.org/data/definitions/290.html");
  script_set_attribute(attribute:"see_also", value:"https://cwe.mitre.org/data/definitions/347.html");
  script_set_attribute(attribute:"see_also", value:"https://cwe.mitre.org/data/definitions/295.html");
  script_set_attribute(attribute:"see_also", value:"https://cwe.mitre.org/data/definitions/296.html");
  script_set_attribute(attribute:"see_also", value:"https://access.redhat.com/errata/RHSA-2020:1080");
  script_set_attribute(attribute:"see_also", value:"https://access.redhat.com/security/cve/CVE-2018-15587");
  script_set_attribute(attribute:"see_also", value:"https://access.redhat.com/security/cve/CVE-2019-3890");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.redhat.com/1392567");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.redhat.com/1753122");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.redhat.com/1753123");
  script_set_attribute(attribute:"solution", value:
"Update the affected packages.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2019-3890");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_cwe_id(290, 295, 296, 347);

  script_set_attribute(attribute:"vuln_publication_date", value:"2019/02/11");
  script_set_attribute(attribute:"patch_publication_date", value:"2020/03/31");
  script_set_attribute(attribute:"plugin_publication_date", value:"2020/04/01");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:7");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:7::client");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:7::computenode");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:7::server");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:7::workstation");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:atk");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:atk-devel");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:evolution");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:evolution-bogofilter");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:evolution-data-server");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:evolution-data-server-devel");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:evolution-data-server-doc");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:evolution-data-server-langpacks");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:evolution-data-server-perl");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:evolution-data-server-tests");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:evolution-devel");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:evolution-devel-docs");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:evolution-ews");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:evolution-ews-langpacks");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:evolution-help");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:evolution-langpacks");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:evolution-pst");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:evolution-spamassassin");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Red Hat Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list", "Host/cpu");

  exit(0);
}


include('audit.inc');
include('global_settings.inc');
include('misc_func.inc');
include('rpm.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
release = get_kb_item('Host/RedHat/release');
if (isnull(release) || 'Red Hat' >!< release) audit(AUDIT_OS_NOT, 'Red Hat');
os_ver = pregmatch(pattern: "Red Hat Enterprise Linux.*release ([0-9]+(\.[0-9]+)?)", string:release);
if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, 'Red Hat');
os_ver = os_ver[1];
if (! preg(pattern:"^7([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, 'Red Hat 7.x', 'Red Hat ' + os_ver);

if (!get_kb_item('Host/RedHat/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('x86_64' >!< cpu && cpu !~ "^i[3-6]86$" && 's390' >!< cpu && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Red Hat', cpu);

pkgs = [
    {'reference':'atk-2.28.1-2.el7', 'cpu':'i686', 'release':'7'},
    {'reference':'atk-2.28.1-2.el7', 'cpu':'s390', 'release':'7'},
    {'reference':'atk-2.28.1-2.el7', 'cpu':'s390x', 'release':'7'},
    {'reference':'atk-2.28.1-2.el7', 'cpu':'x86_64', 'release':'7'},
    {'reference':'atk-devel-2.28.1-2.el7', 'cpu':'i686', 'release':'7'},
    {'reference':'atk-devel-2.28.1-2.el7', 'cpu':'s390', 'release':'7'},
    {'reference':'atk-devel-2.28.1-2.el7', 'cpu':'s390x', 'release':'7'},
    {'reference':'atk-devel-2.28.1-2.el7', 'cpu':'x86_64', 'release':'7'},
    {'reference':'evolution-3.28.5-8.el7', 'cpu':'i686', 'release':'7'},
    {'reference':'evolution-3.28.5-8.el7', 'cpu':'x86_64', 'release':'7'},
    {'reference':'evolution-bogofilter-3.28.5-8.el7', 'cpu':'x86_64', 'release':'7'},
    {'reference':'evolution-data-server-3.28.5-4.el7', 'cpu':'i686', 'release':'7'},
    {'reference':'evolution-data-server-3.28.5-4.el7', 'cpu':'s390', 'release':'7'},
    {'reference':'evolution-data-server-3.28.5-4.el7', 'cpu':'s390x', 'release':'7'},
    {'reference':'evolution-data-server-3.28.5-4.el7', 'cpu':'x86_64', 'release':'7'},
    {'reference':'evolution-data-server-devel-3.28.5-4.el7', 'cpu':'i686', 'release':'7'},
    {'reference':'evolution-data-server-devel-3.28.5-4.el7', 'cpu':'s390', 'release':'7'},
    {'reference':'evolution-data-server-devel-3.28.5-4.el7', 'cpu':'s390x', 'release':'7'},
    {'reference':'evolution-data-server-devel-3.28.5-4.el7', 'cpu':'x86_64', 'release':'7'},
    {'reference':'evolution-data-server-doc-3.28.5-4.el7', 'release':'7'},
    {'reference':'evolution-data-server-langpacks-3.28.5-4.el7', 'release':'7'},
    {'reference':'evolution-data-server-perl-3.28.5-4.el7', 'cpu':'s390x', 'release':'7'},
    {'reference':'evolution-data-server-perl-3.28.5-4.el7', 'cpu':'x86_64', 'release':'7'},
    {'reference':'evolution-data-server-tests-3.28.5-4.el7', 'cpu':'i686', 'release':'7'},
    {'reference':'evolution-data-server-tests-3.28.5-4.el7', 'cpu':'s390', 'release':'7'},
    {'reference':'evolution-data-server-tests-3.28.5-4.el7', 'cpu':'s390x', 'release':'7'},
    {'reference':'evolution-data-server-tests-3.28.5-4.el7', 'cpu':'x86_64', 'release':'7'},
    {'reference':'evolution-devel-3.28.5-8.el7', 'cpu':'i686', 'release':'7'},
    {'reference':'evolution-devel-3.28.5-8.el7', 'cpu':'x86_64', 'release':'7'},
    {'reference':'evolution-devel-docs-3.28.5-8.el7', 'release':'7'},
    {'reference':'evolution-ews-3.28.5-5.el7', 'cpu':'i686', 'release':'7'},
    {'reference':'evolution-ews-3.28.5-5.el7', 'cpu':'x86_64', 'release':'7'},
    {'reference':'evolution-ews-langpacks-3.28.5-5.el7', 'release':'7'},
    {'reference':'evolution-help-3.28.5-8.el7', 'release':'7'},
    {'reference':'evolution-langpacks-3.28.5-8.el7', 'release':'7'},
    {'reference':'evolution-pst-3.28.5-8.el7', 'cpu':'x86_64', 'release':'7'},
    {'reference':'evolution-spamassassin-3.28.5-8.el7', 'cpu':'x86_64', 'release':'7'}
];

flag = 0;
foreach package_array ( pkgs ) {
  reference = NULL;
  release = NULL;
  sp = NULL;
  cpu = NULL;
  el_string = NULL;
  rpm_spec_vers_cmp = NULL;
  epoch = NULL;
  if (!empty_or_null(package_array['reference'])) reference = package_array['reference'];
  if (!empty_or_null(package_array['release'])) release = 'RHEL' + package_array['release'];
  if (!empty_or_null(package_array['sp'])) sp = package_array['sp'];
  if (!empty_or_null(package_array['cpu'])) cpu = package_array['cpu'];
  if (!empty_or_null(package_array['el_string'])) el_string = package_array['el_string'];
  if (!empty_or_null(package_array['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = package_array['rpm_spec_vers_cmp'];
  if (!empty_or_null(package_array['epoch'])) epoch = package_array['epoch'];
  if (reference && release) {
    if (rpm_spec_vers_cmp) {
      if (rpm_check(release:release, sp:sp, cpu:cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:TRUE)) flag++;
    }
    else
    {
      if (rpm_check(release:release, sp:sp, cpu:cpu, reference:reference, epoch:epoch)) flag++;
    }
  }
}

if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_WARNING,
      extra      : rpm_report_get() + redhat_report_package_caveat()
  );
  exit(0);
}
else
{
  tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'atk / atk-devel / evolution / etc');
}
  • NASL familyScientific Linux Local Security Checks
    NASL idSL_20200407_EVOLUTION_ON_SL7_X.NASL
    description* evolution: specially crafted email leading to OpenPGP signatures being spoofed for arbitrary messages * evolution-ews: all certificate errors ignored if error is ignored during initial account setup in gnome-online-accounts
    last seen2020-04-30
    modified2020-04-21
    plugin id135807
    published2020-04-21
    reporterThis script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/135807
    titleScientific Linux Security Update : evolution on SL7.x x86_64 (20200407)
    code
    #
# (C) Tenable Network Security, Inc.
#
# The descriptive text is (C) Scientific Linux.
#

include("compat.inc");

if (description)
{
  script_id(135807);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2020/04/24");

  script_cve_id("CVE-2018-15587", "CVE-2019-3890");

  script_name(english:"Scientific Linux Security Update : evolution on SL7.x x86_64 (20200407)");
  script_summary(english:"Checks rpm output for the updated packages");

  script_set_attribute(
    attribute:"synopsis", 
    value:
"The remote Scientific Linux host is missing one or more security
updates."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"* evolution: specially crafted email leading to OpenPGP signatures
being spoofed for arbitrary messages * evolution-ews: all certificate
errors ignored if error is ignored during initial account setup in
gnome-online-accounts"
  );
  # https://listserv.fnal.gov/scripts/wa.exe?A2=ind2004&L=SCIENTIFIC-LINUX-ERRATA&P=3337
  script_set_attribute(
    attribute:"see_also",
    value:"http://www.nessus.org/u?a8e153c1"
  );
  script_set_attribute(attribute:"solution", value:"Update the affected packages.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:atk");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:atk-debuginfo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:atk-devel");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:evolution");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:evolution-bogofilter");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:evolution-data-server");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:evolution-data-server-debuginfo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:evolution-data-server-devel");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:evolution-data-server-doc");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:evolution-data-server-langpacks");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:evolution-data-server-perl");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:evolution-data-server-tests");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:evolution-debuginfo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:evolution-devel");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:evolution-devel-docs");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:evolution-ews");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:evolution-ews-debuginfo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:evolution-ews-langpacks");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:evolution-help");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:evolution-langpacks");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:evolution-pst");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:evolution-spamassassin");
  script_set_attribute(attribute:"cpe", value:"x-cpe:/o:fermilab:scientific_linux");

  script_set_attribute(attribute:"vuln_publication_date", value:"2019/02/11");
  script_set_attribute(attribute:"patch_publication_date", value:"2020/04/07");
  script_set_attribute(attribute:"plugin_publication_date", value:"2020/04/21");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
  script_family(english:"Scientific Linux Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/RedHat/release", "Host/RedHat/rpm-list");

  exit(0);
}


include("audit.inc");
include("global_settings.inc");
include("misc_func.inc");
include("rpm.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
release = get_kb_item("Host/RedHat/release");
if (isnull(release) || "Scientific Linux " >!< release) audit(AUDIT_HOST_NOT, "running Scientific Linux");
os_ver = pregmatch(pattern: "Scientific Linux.*release ([0-9]+(\.[0-9]+)?)", string:release);
if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Scientific Linux");
os_ver = os_ver[1];
if (! preg(pattern:"^7([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Scientific Linux 7.x", "Scientific Linux " + os_ver);
if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

cpu = get_kb_item("Host/cpu");
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if (cpu >!< "x86_64" && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Scientific Linux", cpu);


flag = 0;
if (rpm_check(release:"SL7", cpu:"x86_64", reference:"atk-2.28.1-2.el7")) flag++;
if (rpm_check(release:"SL7", cpu:"x86_64", reference:"atk-debuginfo-2.28.1-2.el7")) flag++;
if (rpm_check(release:"SL7", cpu:"x86_64", reference:"atk-devel-2.28.1-2.el7")) flag++;
if (rpm_check(release:"SL7", cpu:"x86_64", reference:"evolution-3.28.5-8.el7")) flag++;
if (rpm_check(release:"SL7", cpu:"x86_64", reference:"evolution-bogofilter-3.28.5-8.el7")) flag++;
if (rpm_check(release:"SL7", cpu:"x86_64", reference:"evolution-data-server-3.28.5-4.el7")) flag++;
if (rpm_check(release:"SL7", cpu:"x86_64", reference:"evolution-data-server-debuginfo-3.28.5-4.el7")) flag++;
if (rpm_check(release:"SL7", cpu:"x86_64", reference:"evolution-data-server-devel-3.28.5-4.el7")) flag++;
if (rpm_check(release:"SL7", reference:"evolution-data-server-doc-3.28.5-4.el7")) flag++;
if (rpm_check(release:"SL7", reference:"evolution-data-server-langpacks-3.28.5-4.el7")) flag++;
if (rpm_check(release:"SL7", cpu:"x86_64", reference:"evolution-data-server-langpacks-3.28.5-4.el7")) flag++;
if (rpm_check(release:"SL7", cpu:"x86_64", reference:"evolution-data-server-perl-3.28.5-4.el7")) flag++;
if (rpm_check(release:"SL7", cpu:"x86_64", reference:"evolution-data-server-tests-3.28.5-4.el7")) flag++;
if (rpm_check(release:"SL7", cpu:"x86_64", reference:"evolution-debuginfo-3.28.5-8.el7")) flag++;
if (rpm_check(release:"SL7", cpu:"x86_64", reference:"evolution-devel-3.28.5-8.el7")) flag++;
if (rpm_check(release:"SL7", reference:"evolution-devel-docs-3.28.5-8.el7")) flag++;
if (rpm_check(release:"SL7", cpu:"x86_64", reference:"evolution-ews-3.28.5-5.el7")) flag++;
if (rpm_check(release:"SL7", cpu:"x86_64", reference:"evolution-ews-debuginfo-3.28.5-5.el7")) flag++;
if (rpm_check(release:"SL7", reference:"evolution-ews-langpacks-3.28.5-5.el7")) flag++;
if (rpm_check(release:"SL7", reference:"evolution-help-3.28.5-8.el7")) flag++;
if (rpm_check(release:"SL7", reference:"evolution-langpacks-3.28.5-8.el7")) flag++;
if (rpm_check(release:"SL7", cpu:"x86_64", reference:"evolution-pst-3.28.5-8.el7")) flag++;
if (rpm_check(release:"SL7", cpu:"x86_64", reference:"evolution-spamassassin-3.28.5-8.el7")) flag++;


if (flag)
{
  security_report_v4(
    port       : 0,
    severity   : SECURITY_WARNING,
    extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "atk / atk-debuginfo / atk-devel / evolution / evolution-bogofilter / etc");
}
  • NASL familyDebian Local Security Checks
    NASL idDEBIAN_DLA-1766.NASL
    descriptionHanno B&ouml;ck discovered that GNOME Evolution is prone to OpenPGP signatures being spoofed for arbitrary messages using a specially crafted HTML email. This issue was mitigated by moving the security bar with encryption and signature information above the message headers. For Debian 8
    last seen2020-06-01
    modified2020-06-02
    plugin id124339
    published2019-04-29
    reporterThis script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/124339
    titleDebian DLA-1766-1 : evolution security update
    code
    #
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Debian Security Advisory DLA-1766-1. The text
# itself is copyright (C) Software in the Public Interest, Inc.
#

include("compat.inc");

if (description)
{
  script_id(124339);
  script_version("1.2");
  script_cvs_date("Date: 2019/05/17  9:44:17");

  script_cve_id("CVE-2018-15587");

  script_name(english:"Debian DLA-1766-1 : evolution security update");
  script_summary(english:"Checks dpkg output for the updated packages.");

  script_set_attribute(
    attribute:"synopsis", 
    value:"The remote Debian host is missing a security update."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"Hanno B&ouml;ck discovered that GNOME Evolution is prone to OpenPGP
signatures being spoofed for arbitrary messages using a specially
crafted HTML email. This issue was mitigated by moving the security
bar with encryption and signature information above the message
headers.

For Debian 8 'Jessie', this problem has been fixed in version
3.12.9~git20141130.241663-1+deb8u1.

We recommend that you upgrade your evolution packages.

NOTE: Tenable Network Security has extracted the preceding description
block directly from the DLA security advisory. Tenable has attempted
to automatically clean and format it as much as possible without
introducing additional issues."
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://lists.debian.org/debian-lts-announce/2019/04/msg00027.html"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://packages.debian.org/source/jessie/evolution"
  );
  script_set_attribute(attribute:"solution", value:"Upgrade the affected packages.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:evolution");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:evolution-common");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:evolution-dbg");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:evolution-dev");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:evolution-plugins");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:evolution-plugins-experimental");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libevolution");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:8.0");

  script_set_attribute(attribute:"vuln_publication_date", value:"2019/02/11");
  script_set_attribute(attribute:"patch_publication_date", value:"2019/04/26");
  script_set_attribute(attribute:"plugin_publication_date", value:"2019/04/29");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
  script_family(english:"Debian Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/Debian/release", "Host/Debian/dpkg-l");

  exit(0);
}


include("audit.inc");
include("debian_package.inc");


if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
if (!get_kb_item("Host/Debian/release")) audit(AUDIT_OS_NOT, "Debian");
if (!get_kb_item("Host/Debian/dpkg-l")) audit(AUDIT_PACKAGE_LIST_MISSING);


flag = 0;
if (deb_check(release:"8.0", prefix:"evolution", reference:"3.12.9~git20141130.241663-1+deb8u1")) flag++;
if (deb_check(release:"8.0", prefix:"evolution-common", reference:"3.12.9~git20141130.241663-1+deb8u1")) flag++;
if (deb_check(release:"8.0", prefix:"evolution-dbg", reference:"3.12.9~git20141130.241663-1+deb8u1")) flag++;
if (deb_check(release:"8.0", prefix:"evolution-dev", reference:"3.12.9~git20141130.241663-1+deb8u1")) flag++;
if (deb_check(release:"8.0", prefix:"evolution-plugins", reference:"3.12.9~git20141130.241663-1+deb8u1")) flag++;
if (deb_check(release:"8.0", prefix:"evolution-plugins-experimental", reference:"3.12.9~git20141130.241663-1+deb8u1")) flag++;
if (deb_check(release:"8.0", prefix:"libevolution", reference:"3.12.9~git20141130.241663-1+deb8u1")) flag++;

if (flag)
{
  if (report_verbosity > 0) security_warning(port:0, extra:deb_report_get());
  else security_warning(0);
  exit(0);
}
else audit(AUDIT_HOST_NOT, "affected");
  • NASL familyDebian Local Security Checks
    NASL idDEBIAN_DSA-4457.NASL
    descriptionHanno Bock discovered that Evolution was vulnerable to OpenPGP signatures being spoofed for arbitrary messages using a specially crafted HTML email. This issue was mitigated by moving the security bar with encryption and signature information above the message headers.
    last seen2020-06-01
    modified2020-06-02
    plugin id125783
    published2019-06-10
    reporterThis script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/125783
    titleDebian DSA-4457-1 : evolution - security update
    code
    #
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were  
# extracted from Debian Security Advisory DSA-4457. The text 
# itself is copyright (C) Software in the Public Interest, Inc.
#

include("compat.inc");

if (description)
{
  script_id(125783);
  script_version("1.2");
  script_cvs_date("Date: 2019/06/12 10:41:31");

  script_cve_id("CVE-2018-15587");
  script_xref(name:"DSA", value:"4457");

  script_name(english:"Debian DSA-4457-1 : evolution - security update");
  script_summary(english:"Checks dpkg output for the updated package");

  script_set_attribute(
    attribute:"synopsis", 
    value:"The remote Debian host is missing a security-related update."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"Hanno Bock discovered that Evolution was vulnerable to OpenPGP
signatures being spoofed for arbitrary messages using a specially
crafted HTML email. This issue was mitigated by moving the security
bar with encryption and signature information above the message
headers."
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=924616"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://security-tracker.debian.org/tracker/source-package/evolution"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://packages.debian.org/source/stretch/evolution"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://www.debian.org/security/2019/dsa-4457"
  );
  script_set_attribute(
    attribute:"solution", 
    value:
"Upgrade the evolution packages.

For the stable distribution (stretch), this problem has been fixed in
version 3.22.6-1+deb9u2."
  );
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:evolution");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:9.0");

  script_set_attribute(attribute:"vuln_publication_date", value:"2019/02/11");
  script_set_attribute(attribute:"patch_publication_date", value:"2019/06/07");
  script_set_attribute(attribute:"plugin_publication_date", value:"2019/06/10");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
  script_family(english:"Debian Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/Debian/release", "Host/Debian/dpkg-l");

  exit(0);
}


include("audit.inc");
include("debian_package.inc");


if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
if (!get_kb_item("Host/Debian/release")) audit(AUDIT_OS_NOT, "Debian");
if (!get_kb_item("Host/Debian/dpkg-l")) audit(AUDIT_PACKAGE_LIST_MISSING);


flag = 0;
if (deb_check(release:"9.0", prefix:"evolution", reference:"3.22.6-1+deb9u2")) flag++;
if (deb_check(release:"9.0", prefix:"evolution-common", reference:"3.22.6-1+deb9u2")) flag++;
if (deb_check(release:"9.0", prefix:"evolution-dev", reference:"3.22.6-1+deb9u2")) flag++;
if (deb_check(release:"9.0", prefix:"evolution-plugins", reference:"3.22.6-1+deb9u2")) flag++;
if (deb_check(release:"9.0", prefix:"evolution-plugins-experimental", reference:"3.22.6-1+deb9u2")) flag++;
if (deb_check(release:"9.0", prefix:"libevolution", reference:"3.22.6-1+deb9u2")) flag++;

if (flag)
{
  if (report_verbosity > 0) security_warning(port:0, extra:deb_report_get());
  else security_warning(0);
  exit(0);
}
else audit(AUDIT_HOST_NOT, "affected");
  • NASL familySuSE Local Security Checks
    NASL idSUSE_SU-2019-1266-2.NASL
    descriptionThis update for evolution fixes the following issues : Security issue fixed : CVE-2018-15587: Fixed an issue with spoofed pgp signatures by using specially crafted emails (bsc#1125230). Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id126457
    published2019-07-03
    reporterThis script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/126457
    titleSUSE SLED15 / SLES15 Security Update : evolution (SUSE-SU-2019:1266-2)
    code
    #
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from SUSE update advisory SUSE-SU-2019:1266-2.
# The text itself is copyright (C) SUSE.
#

include("compat.inc");

if (description)
{
  script_id(126457);
  script_version("1.3");
  script_cvs_date("Date: 2019/09/10 13:51:51");

  script_cve_id("CVE-2018-15587");

  script_name(english:"SUSE SLED15 / SLES15 Security Update : evolution (SUSE-SU-2019:1266-2)");
  script_summary(english:"Checks rpm output for the updated packages.");

  script_set_attribute(
    attribute:"synopsis", 
    value:"The remote SUSE host is missing one or more security updates."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"This update for evolution fixes the following issues :

Security issue fixed :

CVE-2018-15587: Fixed an issue with spoofed pgp signatures by using
specially crafted emails (bsc#1125230).

Note that Tenable Network Security has extracted the preceding
description block directly from the SUSE security advisory. Tenable
has attempted to automatically clean and format it as much as possible
without introducing additional issues."
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.suse.com/show_bug.cgi?id=1125230"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://www.suse.com/security/cve/CVE-2018-15587/"
  );
  # https://www.suse.com/support/update/announcement/2019/suse-su-20191266-2/
  script_set_attribute(
    attribute:"see_also",
    value:"http://www.nessus.org/u?3932fbe1"
  );
  script_set_attribute(
    attribute:"solution", 
    value:
"To install this SUSE Security Update use the SUSE recommended
installation methods like YaST online_update or 'zypper patch'.

Alternatively you can run the command listed for your product :

SUSE Linux Enterprise Workstation Extension 15-SP1:zypper in -t patch
SUSE-SLE-Product-WE-15-SP1-2019-1266=1

SUSE Linux Enterprise Module for Open Buildservice Development Tools
15-SP1:zypper in -t patch
SUSE-SLE-Module-Development-Tools-OBS-15-SP1-2019-1266=1"
  );
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:evolution-debuginfo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:evolution-debugsource");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:glade-catalog-evolution");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:glade-catalog-evolution-debuginfo");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:suse_linux:15");

  script_set_attribute(attribute:"vuln_publication_date", value:"2019/02/11");
  script_set_attribute(attribute:"patch_publication_date", value:"2019/07/02");
  script_set_attribute(attribute:"plugin_publication_date", value:"2019/07/03");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
  script_family(english:"SuSE Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/SuSE/release", "Host/SuSE/rpm-list");

  exit(0);
}


include("audit.inc");
include("global_settings.inc");
include("rpm.inc");


if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
release = get_kb_item("Host/SuSE/release");
if (isnull(release) || release !~ "^(SLED|SLES)") audit(AUDIT_OS_NOT, "SUSE");
os_ver = pregmatch(pattern: "^(SLE(S|D)\d+)", string:release);
if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "SUSE");
os_ver = os_ver[1];
if (! preg(pattern:"^(SLED15|SLES15)$", string:os_ver)) audit(AUDIT_OS_NOT, "SUSE SLED15 / SLES15", "SUSE " + os_ver);

if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

cpu = get_kb_item("Host/cpu");
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if (cpu !~ "^i[3-6]86$" && "x86_64" >!< cpu && "s390x" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "SUSE " + os_ver, cpu);

sp = get_kb_item("Host/SuSE/patchlevel");
if (isnull(sp)) sp = "0";
if (os_ver == "SLES15" && (! preg(pattern:"^(1)$", string:sp))) audit(AUDIT_OS_NOT, "SLES15 SP1", os_ver + " SP" + sp);
if (os_ver == "SLED15" && (! preg(pattern:"^(1)$", string:sp))) audit(AUDIT_OS_NOT, "SLED15 SP1", os_ver + " SP" + sp);


flag = 0;
if (rpm_check(release:"SLES15", sp:"1", reference:"evolution-debuginfo-3.26.6-4.3.1")) flag++;
if (rpm_check(release:"SLES15", sp:"1", reference:"evolution-debugsource-3.26.6-4.3.1")) flag++;
if (rpm_check(release:"SLES15", sp:"1", reference:"glade-catalog-evolution-3.26.6-4.3.1")) flag++;
if (rpm_check(release:"SLES15", sp:"1", reference:"glade-catalog-evolution-debuginfo-3.26.6-4.3.1")) flag++;
if (rpm_check(release:"SLED15", sp:"1", reference:"evolution-debuginfo-3.26.6-4.3.1")) flag++;
if (rpm_check(release:"SLED15", sp:"1", reference:"evolution-debugsource-3.26.6-4.3.1")) flag++;
if (rpm_check(release:"SLED15", sp:"1", reference:"glade-catalog-evolution-3.26.6-4.3.1")) flag++;
if (rpm_check(release:"SLED15", sp:"1", reference:"glade-catalog-evolution-debuginfo-3.26.6-4.3.1")) flag++;


if (flag)
{
  if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());
  else security_warning(0);
  exit(0);
}
else
{
  tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "evolution");
}
  • NASL familySuSE Local Security Checks
    NASL idOPENSUSE-2019-1453.NASL
    descriptionThis update for evolution fixes the following issues : Security issue fixed : - CVE-2018-15587: Fixed an issue with spoofed pgp signatures by using specially crafted emails (bsc#1125230). This update was imported from the SUSE:SLE-15:Update update project.
    last seen2020-06-01
    modified2020-06-02
    plugin id125454
    published2019-05-28
    reporterThis script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/125454
    titleopenSUSE Security Update : evolution (openSUSE-2019-1453)
    code
    #
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from openSUSE Security Update openSUSE-2019-1453.
#
# The text description of this plugin is (C) SUSE LLC.
#

include("compat.inc");

if (description)
{
  script_id(125454);
  script_version("1.2");
  script_cvs_date("Date: 2019/05/30 11:03:54");

  script_cve_id("CVE-2018-15587");

  script_name(english:"openSUSE Security Update : evolution (openSUSE-2019-1453)");
  script_summary(english:"Check for the openSUSE-2019-1453 patch");

  script_set_attribute(
    attribute:"synopsis", 
    value:"The remote openSUSE host is missing a security update."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"This update for evolution fixes the following issues :

Security issue fixed :

  - CVE-2018-15587: Fixed an issue with spoofed pgp
    signatures by using specially crafted emails
    (bsc#1125230).

This update was imported from the SUSE:SLE-15:Update update project."
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1125230"
  );
  script_set_attribute(
    attribute:"solution", 
    value:"Update the affected evolution packages."
  );
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:evolution");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:evolution-debuginfo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:evolution-debugsource");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:evolution-devel");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:evolution-lang");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:evolution-plugin-bogofilter");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:evolution-plugin-bogofilter-debuginfo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:evolution-plugin-pst-import");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:evolution-plugin-pst-import-debuginfo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:evolution-plugin-spamassassin");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:evolution-plugin-spamassassin-debuginfo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:glade-catalog-evolution");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:glade-catalog-evolution-debuginfo");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:opensuse:15.0");

  script_set_attribute(attribute:"vuln_publication_date", value:"2019/02/11");
  script_set_attribute(attribute:"patch_publication_date", value:"2019/05/27");
  script_set_attribute(attribute:"plugin_publication_date", value:"2019/05/28");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
  script_family(english:"SuSE Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/SuSE/release", "Host/SuSE/rpm-list", "Host/cpu");

  exit(0);
}


include("audit.inc");
include("global_settings.inc");
include("rpm.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
release = get_kb_item("Host/SuSE/release");
if (isnull(release) || release =~ "^(SLED|SLES)") audit(AUDIT_OS_NOT, "openSUSE");
if (release !~ "^(SUSE15\.0)$") audit(AUDIT_OS_RELEASE_NOT, "openSUSE", "15.0", release);
if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

ourarch = get_kb_item("Host/cpu");
if (!ourarch) audit(AUDIT_UNKNOWN_ARCH);
if (ourarch !~ "^(x86_64)$") audit(AUDIT_ARCH_NOT, "x86_64", ourarch);

flag = 0;

if ( rpm_check(release:"SUSE15.0", reference:"evolution-3.26.6-lp150.3.3.1") ) flag++;
if ( rpm_check(release:"SUSE15.0", reference:"evolution-debuginfo-3.26.6-lp150.3.3.1") ) flag++;
if ( rpm_check(release:"SUSE15.0", reference:"evolution-debugsource-3.26.6-lp150.3.3.1") ) flag++;
if ( rpm_check(release:"SUSE15.0", reference:"evolution-devel-3.26.6-lp150.3.3.1") ) flag++;
if ( rpm_check(release:"SUSE15.0", reference:"evolution-lang-3.26.6-lp150.3.3.1") ) flag++;
if ( rpm_check(release:"SUSE15.0", reference:"evolution-plugin-bogofilter-3.26.6-lp150.3.3.1") ) flag++;
if ( rpm_check(release:"SUSE15.0", reference:"evolution-plugin-bogofilter-debuginfo-3.26.6-lp150.3.3.1") ) flag++;
if ( rpm_check(release:"SUSE15.0", reference:"evolution-plugin-pst-import-3.26.6-lp150.3.3.1") ) flag++;
if ( rpm_check(release:"SUSE15.0", reference:"evolution-plugin-pst-import-debuginfo-3.26.6-lp150.3.3.1") ) flag++;
if ( rpm_check(release:"SUSE15.0", reference:"evolution-plugin-spamassassin-3.26.6-lp150.3.3.1") ) flag++;
if ( rpm_check(release:"SUSE15.0", reference:"evolution-plugin-spamassassin-debuginfo-3.26.6-lp150.3.3.1") ) flag++;
if ( rpm_check(release:"SUSE15.0", reference:"glade-catalog-evolution-3.26.6-lp150.3.3.1") ) flag++;
if ( rpm_check(release:"SUSE15.0", reference:"glade-catalog-evolution-debuginfo-3.26.6-lp150.3.3.1") ) flag++;

if (flag)
{
  if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());
  else security_warning(0);
  exit(0);
}
else
{
  tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "evolution / evolution-debuginfo / evolution-debugsource / etc");
}
  • NASL familyUbuntu Local Security Checks
    NASL idUBUNTU_USN-3998-1.NASL
    descriptionMarcus Brinkmann discovered that Evolution Data Server did not correctly interpret the output from GPG when decrypting encrypted messages. Under certain circumstances, this could result in displaying clear-text portions of encrypted messages as though they were encrypted. Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id125621
    published2019-05-31
    reporterUbuntu Security Notice (C) 2019 Canonical, Inc. / NASL script (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/125621
    titleUbuntu 16.04 LTS / 18.04 LTS : evolution-data-server vulnerability (USN-3998-1)
  • NASL familySuSE Local Security Checks
    NASL idSUSE_SU-2019-1266-1.NASL
    descriptionThis update for evolution fixes the following issues : Security issue fixed : CVE-2018-15587: Fixed an issue with spoofed pgp signatures by using specially crafted emails (bsc#1125230). Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id125245
    published2019-05-17
    reporterThis script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/125245
    titleSUSE SLED15 / SLES15 Security Update : evolution (SUSE-SU-2019:1266-1)
  • NASL familyCentOS Local Security Checks
    NASL idCENTOS_RHSA-2020-1080.NASL
    descriptionThe remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:1080 advisory. - evolution: specially crafted email leading to OpenPGP signatures being spoofed for arbitrary messages (CVE-2018-15587) - evolution-ews: all certificate errors ignored if error is ignored during initial account setup in gnome-online- accounts (CVE-2019-3890) Note that Nessus has not tested for this issue but has instead relied only on the application
    last seen2020-06-06
    modified2020-04-10
    plugin id135332
    published2020-04-10
    reporterThis script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/135332
    titleCentOS 7 : atk / evolution / evolution-data-server / evolution-ews (CESA-2020:1080)

Redhat

advisories
bugzilla
id1791547
title[abrt] [faf] test-cal-meta-backend cannot run without installed Evolution
oval
OR
  • commentRed Hat Enterprise Linux must be installed
    ovaloval:com.redhat.rhba:tst:20070304026
  • AND
    • commentRed Hat Enterprise Linux 8 is installed
      ovaloval:com.redhat.rhba:tst:20193384074
    • OR
      • AND
        • commentevolution-ews-langpacks is earlier than 0:3.28.5-9.el8
          ovaloval:com.redhat.rhsa:tst:20201600001
        • commentevolution-ews-langpacks is signed with Red Hat redhatrelease2 key
          ovaloval:com.redhat.rhsa:tst:20183140590
      • AND
        • commentevolution-ews-debugsource is earlier than 0:3.28.5-9.el8
          ovaloval:com.redhat.rhsa:tst:20201600003
        • commentevolution-ews-debugsource is signed with Red Hat redhatrelease2 key
          ovaloval:com.redhat.rhsa:tst:20193699002
      • AND
        • commentevolution-ews is earlier than 0:3.28.5-9.el8
          ovaloval:com.redhat.rhsa:tst:20201600005
        • commentevolution-ews is signed with Red Hat redhatrelease2 key
          ovaloval:com.redhat.rhba:tst:20162206010
      • AND
        • commentevolution-debugsource is earlier than 0:3.28.5-12.el8
          ovaloval:com.redhat.rhsa:tst:20201600007
        • commentevolution-debugsource is signed with Red Hat redhatrelease2 key
          ovaloval:com.redhat.rhsa:tst:20193699030
      • AND
        • commentevolution-devel is earlier than 0:3.28.5-12.el8
          ovaloval:com.redhat.rhsa:tst:20201600009
        • commentevolution-devel is signed with Red Hat redhatrelease2 key
          ovaloval:com.redhat.rhsa:tst:20130516006
      • AND
        • commentevolution-langpacks is earlier than 0:3.28.5-12.el8
          ovaloval:com.redhat.rhsa:tst:20201600011
        • commentevolution-langpacks is signed with Red Hat redhatrelease2 key
          ovaloval:com.redhat.rhsa:tst:20183140672
      • AND
        • commentevolution-help is earlier than 0:3.28.5-12.el8
          ovaloval:com.redhat.rhsa:tst:20201600013
        • commentevolution-help is signed with Red Hat redhatrelease2 key
          ovaloval:com.redhat.rhsa:tst:20130516014
      • AND
        • commentevolution-spamassassin is earlier than 0:3.28.5-12.el8
          ovaloval:com.redhat.rhsa:tst:20201600015
        • commentevolution-spamassassin is signed with Red Hat redhatrelease2 key
          ovaloval:com.redhat.rhsa:tst:20130516008
      • AND
        • commentevolution-pst is earlier than 0:3.28.5-12.el8
          ovaloval:com.redhat.rhsa:tst:20201600017
        • commentevolution-pst is signed with Red Hat redhatrelease2 key
          ovaloval:com.redhat.rhsa:tst:20130516004
      • AND
        • commentevolution-bogofilter is earlier than 0:3.28.5-12.el8
          ovaloval:com.redhat.rhsa:tst:20201600019
        • commentevolution-bogofilter is signed with Red Hat redhatrelease2 key
          ovaloval:com.redhat.rhsa:tst:20183140666
      • AND
        • commentevolution is earlier than 0:3.28.5-12.el8
          ovaloval:com.redhat.rhsa:tst:20201600021
        • commentevolution is signed with Red Hat redhatrelease2 key
          ovaloval:com.redhat.rhsa:tst:20130516012
      • AND
        • commentevolution-data-server-debugsource is earlier than 0:3.28.5-13.el8
          ovaloval:com.redhat.rhsa:tst:20201600023
        • commentevolution-data-server-debugsource is signed with Red Hat redhatrelease2 key
          ovaloval:com.redhat.rhsa:tst:20193699014
      • AND
        • commentevolution-data-server-tests is earlier than 0:3.28.5-13.el8
          ovaloval:com.redhat.rhsa:tst:20201600025
        • commentevolution-data-server-tests is signed with Red Hat redhatrelease2 key
          ovaloval:com.redhat.rhsa:tst:20183140582
      • AND
        • commentevolution-data-server-perl is earlier than 0:3.28.5-13.el8
          ovaloval:com.redhat.rhsa:tst:20201600027
        • commentevolution-data-server-perl is signed with Red Hat redhatrelease2 key
          ovaloval:com.redhat.rhsa:tst:20183140580
      • AND
        • commentevolution-data-server-doc is earlier than 0:3.28.5-13.el8
          ovaloval:com.redhat.rhsa:tst:20201600029
        • commentevolution-data-server-doc is signed with Red Hat redhatrelease2 key
          ovaloval:com.redhat.rhba:tst:20162206018
      • AND
        • commentevolution-data-server-langpacks is earlier than 0:3.28.5-13.el8
          ovaloval:com.redhat.rhsa:tst:20201600031
        • commentevolution-data-server-langpacks is signed with Red Hat redhatrelease2 key
          ovaloval:com.redhat.rhsa:tst:20183140586
      • AND
        • commentevolution-data-server-devel is earlier than 0:3.28.5-13.el8
          ovaloval:com.redhat.rhsa:tst:20201600033
        • commentevolution-data-server-devel is signed with Red Hat redhatrelease2 key
          ovaloval:com.redhat.rhba:tst:20162206020
      • AND
        • commentevolution-data-server is earlier than 0:3.28.5-13.el8
          ovaloval:com.redhat.rhsa:tst:20201600035
        • commentevolution-data-server is signed with Red Hat redhatrelease2 key
          ovaloval:com.redhat.rhba:tst:20162206016
rhsa
idRHSA-2020:1600
released2020-04-28
severityModerate
titleRHSA-2020:1600: evolution security and bug fix update (Moderate)
rpms
  • atk-0:2.28.1-2.el7
  • atk-debuginfo-0:2.28.1-2.el7
  • atk-devel-0:2.28.1-2.el7
  • evolution-0:3.28.5-8.el7
  • evolution-bogofilter-0:3.28.5-8.el7
  • evolution-data-server-0:3.28.5-4.el7
  • evolution-data-server-debuginfo-0:3.28.5-4.el7
  • evolution-data-server-devel-0:3.28.5-4.el7
  • evolution-data-server-doc-0:3.28.5-4.el7
  • evolution-data-server-langpacks-0:3.28.5-4.el7
  • evolution-data-server-perl-0:3.28.5-4.el7
  • evolution-data-server-tests-0:3.28.5-4.el7
  • evolution-debuginfo-0:3.28.5-8.el7
  • evolution-devel-0:3.28.5-8.el7
  • evolution-devel-docs-0:3.28.5-8.el7
  • evolution-ews-0:3.28.5-5.el7
  • evolution-ews-debuginfo-0:3.28.5-5.el7
  • evolution-ews-langpacks-0:3.28.5-5.el7
  • evolution-help-0:3.28.5-8.el7
  • evolution-langpacks-0:3.28.5-8.el7
  • evolution-pst-0:3.28.5-8.el7
  • evolution-spamassassin-0:3.28.5-8.el7
  • evolution-0:3.28.5-12.el8
  • evolution-bogofilter-0:3.28.5-12.el8
  • evolution-bogofilter-debuginfo-0:3.28.5-12.el8
  • evolution-data-server-0:3.28.5-13.el8
  • evolution-data-server-debuginfo-0:3.28.5-13.el8
  • evolution-data-server-debugsource-0:3.28.5-13.el8
  • evolution-data-server-devel-0:3.28.5-13.el8
  • evolution-data-server-doc-0:3.28.5-13.el8
  • evolution-data-server-langpacks-0:3.28.5-13.el8
  • evolution-data-server-perl-0:3.28.5-13.el8
  • evolution-data-server-tests-0:3.28.5-13.el8
  • evolution-data-server-tests-debuginfo-0:3.28.5-13.el8
  • evolution-debuginfo-0:3.28.5-12.el8
  • evolution-debugsource-0:3.28.5-12.el8
  • evolution-devel-0:3.28.5-12.el8
  • evolution-ews-0:3.28.5-9.el8
  • evolution-ews-debuginfo-0:3.28.5-9.el8
  • evolution-ews-debugsource-0:3.28.5-9.el8
  • evolution-ews-langpacks-0:3.28.5-9.el8
  • evolution-help-0:3.28.5-12.el8
  • evolution-langpacks-0:3.28.5-12.el8
  • evolution-pst-0:3.28.5-12.el8
  • evolution-pst-debuginfo-0:3.28.5-12.el8
  • evolution-spamassassin-0:3.28.5-12.el8
  • evolution-spamassassin-debuginfo-0:3.28.5-12.el8

The Hacker News

idTHN:20BF2C23D315483B3CA9190D047C1212
last seen2019-04-30
modified2019-04-30
published2019-04-30
reporterThe Hacker News
sourcehttps://thehackernews.com/2019/04/email-signature-spoofing.html
titleOver Dozen Popular Email Clients Found Vulnerable to Signature Spoofing Attacks

References