security issue in enigmail package <0.94.3 (CVE-2007-1264)

Debian Bug report logs - #415225
security issue in enigmail package <0.94.3 (CVE-2007-1264)

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Daniel Schröter <d.schroeter@gmx.de>

To: submit@bugs.debian.org

Subject: security issue in enigmail package <0.94.3 (CVE-2007-1264)

Date: Sat, 17 Mar 2007 10:25:11 +0100

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Package: enigmail
Version: 2:0.94.2-1
Severity: important
Tags: security

From
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-1264
"Enigmail 0.94.2 and earlier does not properly use the --status-fd
argument when invoking GnuPG, which prevents Enigmail from visually
distinguishing between signed and unsigned portions of OpenPGP messages
with multiple components, which allows remote attackers to forge the
contents of a message without detection."

In Debian this problem just occurs if the patch for gnupg is not
installed. That's why I tagged it as "important" and not "critical".

Can you please update enigmail to version 0.94.3 (or backport the patch).

Thanks!

Bye

	Daniel


- --
=========================================================
(gnu)PGP signierter Key vom heise c't Magazin verfügbar.
http://www.heise.de/security/dienste/pgp/
=========================================================
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.3 (GNU/Linux)

iD8DBQFF+7P3F7lQkYolXTIRAkZEAKDHm0aZy4MuS+dc0ddIppc+GqGvUgCgwXXQ
4f8/DvFZl1WeWod9jR1qPms=
=fIbu
-----END PGP SIGNATURE-----

Message #10 received at 415225@bugs.debian.org (full text, mbox, reply):

From: Alexander Sack <asac@jwsdot.com>

To: Daniel Schröter <d.schroeter@gmx.de>, 415225@bugs.debian.org

Subject: Re: Bug#415225: security issue in enigmail package <0.94.3 (CVE-2007-1264)

Date: Sat, 17 Mar 2007 21:39:05 +0100

On Sat, Mar 17, 2007 at 10:25:11AM +0100, Daniel Schröter wrote:
> From
> http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-1264
> "Enigmail 0.94.2 and earlier does not properly use the --status-fd
> argument when invoking GnuPG, which prevents Enigmail from visually
> distinguishing between signed and unsigned portions of OpenPGP messages
> with multiple components, which allows remote attackers to forge the
> contents of a message without detection."
> 
> In Debian this problem just occurs if the patch for gnupg is not
> installed. That's why I tagged it as "important" and not "critical".
> 
> Can you please update enigmail to version 0.94.3 (or backport the patch).

The gnupg update fixed the security issue. Everything else is just
improved visualization.

 - Alexander

Message #15 received at 415225@bugs.debian.org (full text, mbox, reply):

From: Daniel Schröter <d.schroeter@gmx.de>

To: Alexander Sack <asac@jwsdot.com>, 415225@bugs.debian.org

Subject: Re: Bug#415225: security issue in enigmail package <0.94.3 (CVE-2007-1264)

Date: Sun, 18 Mar 2007 00:39:34 +0100

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Alexander Sack wrote:
>> In Debian this problem just occurs if the patch for gnupg is not
>> installed. That's why I tagged it as "important" and not "critical".
> 
> The gnupg update fixed the security issue. Everything else is just
> improved visualization.

Yes I know that, but like I wrote maybe someone has not installed the
update for gnupg. On the other hand: Why should he then install the
update for enigmail? :-o

Bye
	Daniel


- --
=========================================================
(gnu)PGP signierter Key vom heise c't Magazin verfügbar.
http://www.heise.de/security/dienste/pgp/
=========================================================
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.3 (GNU/Linux)

iD8DBQFF/Hw2F7lQkYolXTIRAiHPAKCxUN9nRh+4xptBdhHTwPaDshCiFACffOBC
B4HTu/YNYbd5NPohhLXqiHI=
=2+wO
-----END PGP SIGNATURE-----

Message #20 received at 415225@bugs.debian.org (full text, mbox, reply):

From: Alexander Sack <asac@jwsdot.com>

To: Daniel Schröter <d.schroeter@gmx.de>

Cc: 415225@bugs.debian.org

Subject: Re: Bug#415225: security issue in enigmail package <0.94.3 (CVE-2007-1264)

Date: Sun, 18 Mar 2007 16:33:01 +0100

On Sun, Mar 18, 2007 at 12:39:34AM +0100, Daniel Schröter wrote:
> Alexander Sack wrote:
> >> In Debian this problem just occurs if the patch for gnupg is not
> >> installed. That's why I tagged it as "important" and not "critical".
> > 
> > The gnupg update fixed the security issue. Everything else is just
> > improved visualization.
> 
> Yes I know that, but like I wrote maybe someone has not installed the
> update for gnupg. On the other hand: Why should he then install the
> update for enigmail? :-o

Exactly :-P

 - Alexander

Message #25 received at 415225-done@bugs.debian.org (full text, mbox, reply):

From: Rolf Leggewie <debian-bugs@rolf.leggewie.biz>

To: 415225-done@bugs.debian.org

Subject: 0.94 is long gone

Date: Wed, 2 Sep 2015 16:35:07 +0800

oldest maintained version in Debian is 1.0.1-5 in unstable

closing

Send a report that this bug log contains spam.