CVE-2013-4166: Infoleak
First published: Wed Jun 12 2013(Updated: )
Description of problem: Hi, this is actually not a RedHat/Fedora bug, it's an Evolution issue but the GNOME bugzilla doesn't seem to support reporting security/private bugs so Milan asked me to report here. When selecting the key for GPG-encrypted mail, Evolution seems to do: gpg --encrypt -r address This is actually a bad idea, because it matches every userid including address (wether in the first or last name, in the comment or in the email address). What makes it worse is that gpg returns the first match, so in case something else matches the email address given (for example name instead of first.name), then the mail will be encrypted to the *wrong* recipient. This looks like a security issue to me, thus marking it as such and reporting it. If you disagree, feel free to change that. In the gpg manpage there's an explanation about how userid can be selected, and for example: By exact match on an email address. This is indicated by enclosing the email address in the usual way with left and right angles. <heinrichh> So the angles should be added to the command line used by Evolution. Note that this still won't work if multiple keys match that email address. Maybe Evolution should do the same as mutt, which seems to first search (using I guess gpg --list) the keys matching a query, then ask the user to select the uid. This would make sure the user actually knows to what recipient the mail is encrypted to. And also note that, right now, there's no way to encrypt the mail to the correct recipient but to delete the key from the keyring. Version-Release number of selected component (if applicable): Evolution 3.8.2 How reproducible: Always Steps to Reproduce: 1. create keys for multiple recipient with matching email addresses (test and foo-test) 2. try to write gpg encrypted mail to both addresses Actual results: Mail is always encrypted to the first matching user id.
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| GNOME Evolution | <=3.8.4 | |
| Gnome Evolution Data Server | <=3.9.5 | |
| Redhat Enterprise Linux Desktop | =6.0 | |
| Redhat Enterprise Linux Server | =6.0 | |
| Redhat Enterprise Linux Workstation | =6.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://rhn.redhat.com/errata/RHSA-2013-1540.html
- http://seclists.org/oss-sec/2013/q3/191
- https://bugzilla.redhat.com/show_bug.cgi?id=973728
- https://git.gnome.org/browse/evolution-data-server/commit/?h=gnome-3-8&id=f7059bb37dcce485d36d769142ec9515708d8ae5
- https://git.gnome.org/browse/evolution-data-server/commit/?id=5d8b92c622f6927b253762ff9310479dd3ac627d
- http://www.openwall.com/lists/oss-security/2013/07/21/2
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=987108
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=973728#c5
- https://access.redhat.com/security/cve/CVE-2013-4166
- https://rhn.redhat.com/errata/RHSA-2013-1540.html
- https://access.redhat.com/support/policy/updates/errata/
Frequently Asked Questions
What is CVE-2013-4166?
CVE-2013-4166 is a vulnerability in GNOME Evolution and Evolution Data Server that allows remote attackers to encrypt an email with the wrong key.
What is the severity of CVE-2013-4166?
CVE-2013-4166 has a severity rating of 7.5 (high).
Which software versions are affected by CVE-2013-4166?
GNOME Evolution version 3.8.4 and earlier, and Evolution Data Server version 3.9.5 and earlier are affected by CVE-2013-4166.
How can CVE-2013-4166 be exploited?
CVE-2013-4166 can be exploited by remote attackers to encrypt an email with the wrong key.
Where can I find more information about CVE-2013-4166?
More information about CVE-2013-4166 can be found in Redhat's Errata RHSA-2013-1540, the OSS Security mailing list, and the Bugzilla entry.
- collector/nvd-index
- agent/type
- agent/remedy
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/references
- agent/weakness
- agent/author
- agent/severity
- agent/last-modified-date
- agent/tags
- agent/description
- agent/event
- agent/first-publish-date
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2013-4166
- vendor/gnome
- canonical/gnome evolution
- version/gnome evolution/3.8.4
- canonical/gnome evolution data server
- version/gnome evolution data server/3.9.5
- vendor/redhat
- canonical/redhat enterprise linux desktop
- version/redhat enterprise linux desktop/6.0
- canonical/redhat enterprise linux server
- version/redhat enterprise linux server/6.0
- canonical/redhat enterprise linux workstation
- version/redhat enterprise linux workstation/6.0