CVE-2013-4166: Infoleak

First published: Wed Jun 12 2013(Updated: )

Description of problem: Hi, this is actually not a RedHat/Fedora bug, it's an Evolution issue but the GNOME bugzilla doesn't seem to support reporting security/private bugs so Milan asked me to report here. When selecting the key for GPG-encrypted mail, Evolution seems to do: gpg --encrypt -r address This is actually a bad idea, because it matches every userid including address (wether in the first or last name, in the comment or in the email address). What makes it worse is that gpg returns the first match, so in case something else matches the email address given (for example name instead of first.name), then the mail will be encrypted to the *wrong* recipient. This looks like a security issue to me, thus marking it as such and reporting it. If you disagree, feel free to change that. In the gpg manpage there's an explanation about how userid can be selected, and for example: By exact match on an email address. This is indicated by enclosing the email address in the usual way with left and right angles. <heinrichh> So the angles should be added to the command line used by Evolution. Note that this still won't work if multiple keys match that email address. Maybe Evolution should do the same as mutt, which seems to first search (using I guess gpg --list) the keys matching a query, then ask the user to select the uid. This would make sure the user actually knows to what recipient the mail is encrypted to. And also note that, right now, there's no way to encrypt the mail to the correct recipient but to delete the key from the keyring. Version-Release number of selected component (if applicable): Evolution 3.8.2 How reproducible: Always Steps to Reproduce: 1. create keys for multiple recipient with matching email addresses (test and foo-test) 2. try to write gpg encrypted mail to both addresses Actual results: Mail is always encrypted to the first matching user id.

Credit: secalert@redhat.com

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

• collector/nvd-index
• agent/type
• agent/remedy
• agent/softwarecombine
• collector/mitre-cve
• source/MITRE
• agent/weakness
• agent/author
• agent/last-modified-date
• collector/redhat-bugzilla
• source/Red Hat
• alias/CVE-2013-4166
• agent/references
• agent/severity
• agent/event
• agent/tags
• agent/first-publish-date
• agent/description
• agent/trending
• vendor/gnome
• canonical/gnome evolution
• version/gnome evolution/3.8.4
• canonical/gnome evolution data server
• version/gnome evolution data server/3.9.5
• vendor/redhat
• canonical/redhat enterprise linux desktop
• version/redhat enterprise linux desktop/6.0
• canonical/redhat enterprise linux server
• version/redhat enterprise linux server/6.0
• canonical/redhat enterprise linux workstation
• version/redhat enterprise linux workstation/6.0