An issue was discovered in Enigmail before 1.9.9. In a variant of CVE-2017-17847, signature spoofing is possible for multipart/related messages because a signed message part can be referenced with a cid: URI but not actually displayed. In other words, the entire containing message appears to be signed, but the recipient does not see any of the signed text.
The product does not verify, or incorrectly verifies, the cryptographic signature for data.
| Link | Tags |
|---|---|
| https://sourceforge.net/p/enigmail/bugs/709/ | third party advisory |
| https://lists.debian.org/debian-security-announce/2017/msg00333.html | third party advisory mailing list |
| https://lists.debian.org/debian-lts-announce/2017/12/msg00021.html | third party advisory mailing list |
| https://www.debian.org/security/2017/dsa-4070 | third party advisory vendor advisory |
| http://www.openwall.com/lists/oss-security/2019/04/30/4 | third party advisory mailing list |
| http://seclists.org/fulldisclosure/2019/Apr/38 | third party advisory mailing list |
| http://packetstormsecurity.com/files/152703/Johnny-You-Are-Fired.html | vdb entry third party advisory |
| https://github.com/RUB-NDS/Johnny-You-Are-Fired | |
| https://github.com/RUB-NDS/Johnny-You-Are-Fired/blob/master/paper/johnny-fired.pdf |