CVE-2017-17843 Information

Description

An issue was discovered in Enigmail before 1.9.9 that allows remote attackers to trigger use of an intended public key for encryption because incorrect regular expressions are used for extraction of an e-mail address from a comma-separated list as demonstrated by a modified Full Name field and a homograph attack aka TBE-01-002.

CVSS Vector

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Reference

https://enigmail.net/download/other/Enigmail20Pentest20Report20by20Cure5320-20Excerpt.pdf https://lists.debian.org/debian-lts-announce/2017/12/msg00021.html https://lists.debian.org/debian-security-announce/2017/msg00333.html https://www.debian.org/security/2017/dsa-4070 https://www.mail-archive.com/enigmail-users@enigmail.net/msg04280.html

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction Required

NONE

Scope

NONE

Confidentiality Impact

UNCHANGED

Integrity Impact

NONE

Availability Impact

HIGH

Base Score

NONE

Base Severity

5.9