CVE-2018-12019

The signature verification routine in Enigmail before 2.0.7 interprets user ids as status/control messages and does not correctly keep track of the status of multiple signatures, which allows remote attackers to spoof arbitrary email signatures via public keys containing crafted primary user ids.

CVSS v3 7.5 HIGH
CVSS v2.0 5.0 MEDIUM

7.5^/10

CVSS v3 : HIGH

Vector : AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

5.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:N/C:N/I:P/A:N

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://openwall.com/lists/oss-security/2018/06/13/10	Mailing List Third Party Advisory
http://packetstormsecurity.com/files/152703/Johnny-You-Are-Fired.html	Third Party Advisory VDB Entry
http://seclists.org/fulldisclosure/2019/Apr/38	Mailing List Third Party Advisory
http://www.openwall.com/lists/oss-security/2019/04/30/4	Mailing List Third Party Advisory
https://github.com/RUB-NDS/Johnny-You-Are-Fired
https://github.com/RUB-NDS/Johnny-You-Are-Fired/blob/master/paper/johnny-fired.pdf
https://www.enigmail.net/index.php/en/download/changelog	Exploit Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:enigmail:enigmail:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2018-06-13 23:29

Updated : 2019-05-16 18:29

NVD link : CVE-2018-12019

Mitre link : CVE-2018-12019

CVE.ORG link : CVE-2018-12019

JSON object : View

Products Affected

enigmail

enigmail

CWE

CWE-347

Improper Verification of Cryptographic Signature

{"id": "CVE-2018-12019", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2018-06-13T23:29:00.393", "references": [{"url": "http://openwall.com/lists/oss-security/2018/06/13/10", "tags": ["Mailing List", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "http://packetstormsecurity.com/files/152703/Johnny-You-Are-Fired.html", "tags": ["Third Party Advisory", "VDB Entry"], "source": "cve@mitre.org"}, {"url": "http://seclists.org/fulldisclosure/2019/Apr/38", "tags": ["Mailing List", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "http://www.openwall.com/lists/oss-security/2019/04/30/4", "tags": ["Mailing List", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://github.com/RUB-NDS/Johnny-You-Are-Fired", "source": "cve@mitre.org"}, {"url": "https://github.com/RUB-NDS/Johnny-You-Are-Fired/blob/master/paper/johnny-fired.pdf", "source": "cve@mitre.org"}, {"url": "https://www.enigmail.net/index.php/en/download/changelog", "tags": ["Exploit", "Vendor Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-347"}]}], "descriptions": [{"lang": "en", "value": "The signature verification routine in Enigmail before 2.0.7 interprets user ids as status/control messages and does not correctly keep track of the status of multiple signatures, which allows remote attackers to spoof arbitrary email signatures via public keys containing crafted primary user ids."}, {"lang": "es", "value": "La rutina de verificaci\u00f3n de firmas en Enigmail en versiones anteriores a la 2.0.7 interpreta los ID de usuario como mensajes de estado/control y no mantiene correctamente el control sobre el estado de m\u00faltiples firmas. Esto permite que atacantes remotos suplanten firmas de email arbitrarias mediante claves p\u00fablicas que contienen ID de usuario primario manipulados."}], "lastModified": "2019-05-16T18:29:00.297", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:enigmail:enigmail:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "03CF0EC6-42AC-4E77-B14D-1E605038A42F", "versionEndExcluding": "2.0.7"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}