CVE-2007-1558

2007-04-1600:00:00

ubuntu.com

2.6 Low

CVSS2

Access Vector

NETWORK

Access Complexity

HIGH

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:H/Au:N/C:P/I:N/A:N

0.063 Low

EPSS

Percentile

93.5%

JSON

The APOP protocol allows remote attackers to guess the first 3 characters
of a password via man-in-the-middle (MITM) attacks that use crafted message
IDs and MD5 collisions. NOTE: this design-level issue potentially affects
all products that use APOP, including (1) Thunderbird 1.x before 1.5.0.12
and 2.x before 2.0.0.4, (2) Evolution, (3) mutt, (4) fetchmail before
6.3.8, (5) SeaMonkey 1.0.x before 1.0.9 and 1.1.x before 1.1.2, (6) Balsa
2.3.16 and earlier, (7) Mailfilter before 0.8.2, and possibly other
products.

Notes

Author	Note
kees	This is a partial attack, not really feasible, so it okay to ignore.
jdstrand	possible fetchmail patch at http://www.securityfocus.com/archive/1/464477/30/0/threaded

OSVersionArchitecturePackageVersionFilename
ubuntu6.06noarchfetchmail< 6.3.2-2ubuntu2.2UNKNOWN
ubuntu6.10noarchfetchmail< 6.3.4-1ubuntu4.2UNKNOWN
ubuntu7.04noarchfetchmail< 6.3.6-1ubuntu2.1UNKNOWN
ubuntu6.06noarchmozilla-thunderbird< 1.5.0.13-0ubuntu0.6.06UNKNOWN
ubuntu6.10noarchmozilla-thunderbird< 1.5.0.13-0ubuntu0.6.10UNKNOWN
ubuntu7.04noarchmozilla-thunderbird< 1.5.0.13-0ubuntu0.7.04UNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	6.06	noarch	fetchmail	< 6.3.2-2ubuntu2.2	UNKNOWN
ubuntu	6.10	noarch	fetchmail	< 6.3.4-1ubuntu4.2	UNKNOWN
ubuntu	7.04	noarch	fetchmail	< 6.3.6-1ubuntu2.1	UNKNOWN
ubuntu	6.06	noarch	mozilla-thunderbird	< 1.5.0.13-0ubuntu0.6.06	UNKNOWN
ubuntu	6.10	noarch	mozilla-thunderbird	< 1.5.0.13-0ubuntu0.6.10	UNKNOWN
ubuntu	7.04	noarch	mozilla-thunderbird	< 1.5.0.13-0ubuntu0.7.04	UNKNOWN