Bug 893330 (CVE-2014-5369) - VUL-0: CVE-2014-5369: enigmail: mail with only Bcc recipients sent in plain text
Summary: VUL-0: CVE-2014-5369: enigmail: mail with only Bcc recipients sent in plain text
Status: RESOLVED FIXED
Alias: CVE-2014-5369
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other openSUSE 13.1
: P3 - Medium : Minor
Target Milestone: ---
Assignee: Security Team bot
QA Contact: Security Team bot
URL: https://smash.suse.de/issue/105302/
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2014-08-25 09:51 UTC by Alexander Bergmann
Modified: 2014-09-08 14:04 UTC (History)
3 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Alexander Bergmann 2014-08-25 09:51:11 UTC
Via oss-security:

http://seclists.org/oss-sec/2014/q3/436

--------------
> http://sourceforge.net/p/enigmail/forum/support/thread/3e7268a4/

This seems to discuss at least two non-identical issues.

http://sourceforge.net/p/enigmail/forum/support/thread/3e7268a4/#b315
and http://sourceforge.net/p/enigmail/bugs/294/ are about "an email
with only Bcc recipients is sent in plain text." This is assigned
CVE-2014-5369.

http://sourceforge.net/p/enigmail/forum/support/thread/3e7268a4/#10f1
and
http://sourceforge.net/p/enigmail/forum/support/thread/3e7268a4/#0a5a
are about one or more issues in which there is unexpected cleartext
e-mail transmission unrelated to use of Bcc. This perhaps requires a
non-default configuration. It is conceivable -- although perhaps
unlikely -- that the problem is a UI bug (e.g., an encryption choice
is presented even when the product is configured to never use
encryption). In any case, none of this has a CVE assignment yet. There
isn't enough information to determine whether to assign zero, one, or
two additional CVE IDs. The scope of CVE-2014-5369 is only the
behavior that occurs when all recipients are Bcc recipients.

Finally, these are additional (possibly related) references that
haven't yet been mentioned on oss-security:

  http://sourceforge.net/p/enigmail/bugs/290/
  http://twitter.com/mtigas/statuses/494228366028210176/photo/1
--------------

References:
http://seclists.org/oss-sec/2014/q3/394
https://bugzilla.redhat.com/show_bug.cgi?id=1133373
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-5369
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-5369
Comment 1 Swamp Workflow Management 2014-08-25 22:00:19 UTC
bugbot adjusting priority
Comment 2 Wolfgang Rosenauer 2014-08-29 12:07:18 UTC
Version 1.7.2 was released and I'm about to prepare it.
Should I submit as soon as ready or should we add enigmail as part of next week's Mozilla updates (Firefox, Thunderbird)?
Comment 3 Benjamin Brunner 2014-08-29 12:41:21 UTC
After the update includes a security-fix, I changed needinfo to the security-team. Thanks Wolfgang.
Comment 4 Marcus Meissner 2014-09-01 09:55:39 UTC
as it is a seperate package you can submit it seperately.
Comment 5 Wolfgang Rosenauer 2014-09-01 10:15:33 UTC
Update packages submitted
Comment 6 Marcus Meissner 2014-09-08 14:01:21 UTC
released
Comment 7 Swamp Workflow Management 2014-09-08 14:04:24 UTC
openSUSE-SU-2014:1096-1: An update that fixes one vulnerability is now available.

Category: security (moderate)
Bug References: 893330
CVE References: CVE-2014-5369
Sources used:
openSUSE 13.1 (src):    enigmail-1.7.2-6.1
openSUSE 12.3 (src):    enigmail-1.7.2-6.1