CVE-2007-1558
CVE-2007-1558
This page contains facts from public vulnerability sources. Check the original advisory before updating.
This page shows selected source facts. See the linked advisories for the complete description and affected versions.
The APOP protocol allows remote attackers to guess the first 3 characters of a password via man-in-the-middle (MITM) attacks that use crafted message IDs and MD5 collisions. NOTE: this design-level issue potentially affects all products that use APOP, including (1) Thunderbird 1.x before 1.5.0.12 and 2.x before 2.0.0.4, (2) Evolution, (3) mutt, (4) fetchmail before 6.3.8, (5) SeaMonkey 1.0.x before 1.0.9 and 1.1.x before 1.1.2, (6) Balsa 2.3.16 and earlier, (7) Mailfilter before 0.8.2, and possibly other products.
EPSS 2.4% · Fix available
- Published
- Updated
Stack: system
Affected products and versions
n/a
- Versions
- n/a: Affected
No fix published
balsa Debian:12
- Affected ranges
- ECOSYSTEM: < 2.3.17-1
Update to 2.3.17-1
balsa Debian:13
- Affected ranges
- ECOSYSTEM: < 2.3.17-1
Update to 2.3.17-1
balsa Debian:14
- Affected ranges
- ECOSYSTEM: < 2.3.17-1
Update to 2.3.17-1
claws-mail Debian:12
- Affected ranges
- ECOSYSTEM: < 2.9.1-1
Update to 2.9.1-1
claws-mail Debian:13
- Affected ranges
- ECOSYSTEM: < 2.9.1-1
Update to 2.9.1-1
claws-mail Debian:14
- Affected ranges
- ECOSYSTEM: < 2.9.1-1
Update to 2.9.1-1
fetchmail Debian:12
- Affected ranges
- ECOSYSTEM: < 6.3.8-1
Update to 6.3.8-1
fetchmail Debian:13
- Affected ranges
- ECOSYSTEM: < 6.3.8-1
Update to 6.3.8-1
fetchmail Debian:14
- Affected ranges
- ECOSYSTEM: < 6.3.8-1
Update to 6.3.8-1
mailfilter Debian:12
- Affected ranges
- ECOSYSTEM: < 0.8.2-1
Update to 0.8.2-1
mailfilter Debian:13
- Affected ranges
- ECOSYSTEM: < 0.8.2-1
Update to 0.8.2-1
mailfilter Debian:14
- Affected ranges
- ECOSYSTEM: < 0.8.2-1
Update to 0.8.2-1
mutt Debian:12
- Affected ranges
- ECOSYSTEM: < 1.5.18-6
Update to 1.5.18-6
mutt Debian:13
- Affected ranges
- ECOSYSTEM: < 1.5.18-6
Update to 1.5.18-6
mutt Debian:14
- Affected ranges
- ECOSYSTEM: < 1.5.18-6
Update to 1.5.18-6
Original sources
- http://secunia.com/advisories/25496
- http://secunia.com/advisories/25529
- http://sourceforge.net/forum/forum.php?forum_id=683706
- http://docs.info.apple.com/article.html?artnum=305530
- http://www.claws-mail.org/news.php
- http://www.mandriva.com/security/advisories?name=MDKSA-2007:107
- http://www.trustix.org/errata/2007/0024/
- http://www.securityfocus.com/archive/1/464569/100/0/threaded
- http://secunia.com/advisories/25894
- http://www.securityfocus.com/archive/1/471455/100/0/threaded
- http://www.vupen.com/english/advisories/2007/1939
- http://secunia.com/advisories/26083
- http://www.vupen.com/english/advisories/2007/1468
- http://www.redhat.com/support/errata/RHSA-2009-1140.html
- http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00774579
- http://www.securityfocus.com/archive/1/470172/100/200/threaded
- http://secunia.com/advisories/26415
- http://fetchmail.berlios.de/fetchmail-SA-2007-01.txt
- http://www.openwall.com/lists/oss-security/2009/08/18/1
- http://lists.apple.com/archives/security-announce/2007/May/msg00004.html
- http://www.novell.com/linux/security/advisories/2007_14_sr.html
- http://secunia.com/advisories/25402
- http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00771742
- https://nvd.nist.gov/vuln/detail/CVE-2007-1558