NVD脆弱性詳細

CVE-2007-1558

概要	The APOP protocol allows remote attackers to guess the first 3 characters of a password via man-in-the-middle (MITM) attacks that use crafted message IDs and MD5 collisions. NOTE: this design-level issue potentially affects all products that use APOP, including (1) Thunderbird 1.x before 1.5.0.12 and 2.x before 2.0.0.4, (2) Evolution, (3) mutt, (4) fetchmail before 6.3.8, (5) SeaMonkey 1.0.x before 1.0.9 and 1.1.x before 1.1.2, (6) Balsa 2.3.16 and earlier, (7) Mailfilter before 0.8.2, and possibly other products.
公表日	2007年4月17日7:19
登録日	2021年1月29日14:09
最終更新日	2018年10月17日1:39

CVSS2.0 : LOW
スコア	2.6
ベクター	AV:N/AC:H/Au:N/C:P/I:N/A:N
攻撃元区分(AV)	ネットワーク
攻撃条件の複雑さ(AC)	高
攻撃前の認証要否(Au)	不要
機密性への影響(C)	低
完全性への影響(I)	なし
可用性への影響(A)	なし
全ての特権を取得	いいえ
ユーザー権限を取得	いいえ
その他の権限を取得	いいえ
ユーザー操作が必要	いいえ

影響を受けるソフトウェアの構成

構成1		以上	以下	より上	未満
cpe:2.3:a:apop_protocol:apop_protocol::::::::

関連情報、対策とツール

No	URL	refsource	タグ
1	ftp://patches.sgi.com/support/free/security/advisories/20070602-01-P.asc	SGI
2	http://balsa.gnome.org/download.html	CONFIRM
3	http://docs.info.apple.com/article.html?artnum=305530	CONFIRM
4	http://fetchmail.berlios.de/fetchmail-SA-2007-01.txt	CONFIRM
5	http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00771742	HP
6	http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00774579	HP
7	http://lists.apple.com/archives/security-announce/2007/May/msg00004.html	APPLE
8	http://mail.gnome.org/archives/balsa-list/2007-July/msg00000.html	MLIST
9	http://secunia.com/advisories/25353	SECUNIA
10	http://secunia.com/advisories/25402	SECUNIA	Vendor Advisory
11	http://secunia.com/advisories/25476	SECUNIA
12	http://secunia.com/advisories/25496	SECUNIA	Vendor Advisory
13	http://secunia.com/advisories/25529	SECUNIA	Vendor Advisory
14	http://secunia.com/advisories/25534	SECUNIA
15	http://secunia.com/advisories/25546	SECUNIA	Vendor Advisory
16	http://secunia.com/advisories/25559	SECUNIA
17	http://secunia.com/advisories/25664	SECUNIA
18	http://secunia.com/advisories/25750	SECUNIA
19	http://secunia.com/advisories/25798	SECUNIA
20	http://secunia.com/advisories/25858	SECUNIA
21	http://secunia.com/advisories/25894	SECUNIA
22	http://secunia.com/advisories/26083	SECUNIA
23	http://secunia.com/advisories/26415	SECUNIA
24	http://secunia.com/advisories/35699	SECUNIA
25	http://security.gentoo.org/glsa/glsa-200706-06.xml	GENTOO
26	http://slackware.com/security/viewer.php?l=slackware-security&y=2007&m=slackware-security.571857	SLACKWARE
27	http://sourceforge.net/forum/forum.php?forum_id=683706	CONFIRM
28	http://sylpheed.sraoss.jp/en/news.html	CONFIRM
29	http://www.claws-mail.org/news.php	CONFIRM
30	http://www.debian.org/security/2007/dsa-1300	DEBIAN
31	http://www.debian.org/security/2007/dsa-1305	DEBIAN	Patch
32	http://www.mandriva.com/security/advisories?name=MDKSA-2007:105	MANDRIVA
33	http://www.mandriva.com/security/advisories?name=MDKSA-2007:107	MANDRIVA
34	http://www.mandriva.com/security/advisories?name=MDKSA-2007:113	MANDRIVA
35	http://www.mandriva.com/security/advisories?name=MDKSA-2007:119	MANDRIVA
36	http://www.mandriva.com/security/advisories?name=MDKSA-2007:131	MANDRIVA
37	http://www.mozilla.org/security/announce/2007/mfsa2007-15.html	CONFIRM	Patch Vendor Advisory
38	http://www.novell.com/linux/security/advisories/2007_14_sr.html	SUSE
39	http://www.novell.com/linux/security/advisories/2007_36_mozilla.html	SUSE
40	http://www.openwall.com/lists/oss-security/2009/08/15/1	MLIST
41	http://www.openwall.com/lists/oss-security/2009/08/18/1	MLIST
42	http://www.redhat.com/support/errata/RHSA-2007-0344.html	REDHAT
43	http://www.redhat.com/support/errata/RHSA-2007-0353.html	REDHAT
44	http://www.redhat.com/support/errata/RHSA-2007-0385.html	REDHAT
45	http://www.redhat.com/support/errata/RHSA-2007-0386.html	REDHAT
46	http://www.redhat.com/support/errata/RHSA-2007-0401.html	REDHAT
47	http://www.redhat.com/support/errata/RHSA-2007-0402.html	REDHAT
48	http://www.redhat.com/support/errata/RHSA-2009-1140.html	REDHAT
49	http://www.securityfocus.com/archive/1/464477/30/0/threaded	BUGTRAQ	Vendor Advisory
50	http://www.securityfocus.com/archive/1/464569/100/0/threaded	BUGTRAQ
51	http://www.securityfocus.com/archive/1/470172/100/200/threaded	BUGTRAQ
52	http://www.securityfocus.com/archive/1/471455/100/0/threaded	BUGTRAQ
53	http://www.securityfocus.com/archive/1/471720/100/0/threaded	BUGTRAQ
54	http://www.securityfocus.com/archive/1/471842/100/0/threaded	BUGTRAQ
55	http://www.securityfocus.com/bid/23257	BID	Patch
56	http://www.securitytracker.com/id?1018008	SECTRACK
57	http://www.trustix.org/errata/2007/0019/	TRUSTIX
58	http://www.trustix.org/errata/2007/0024/	TRUSTIX
59	http://www.ubuntu.com/usn/usn-469-1	UBUNTU
60	http://www.ubuntu.com/usn/usn-520-1	UBUNTU
61	http://www.us-cert.gov/cas/techalerts/TA07-151A.html	CERT	US Government Resource
62	http://www.vupen.com/english/advisories/2007/1466	VUPEN
63	http://www.vupen.com/english/advisories/2007/1467	VUPEN
64	http://www.vupen.com/english/advisories/2007/1468	VUPEN
65	http://www.vupen.com/english/advisories/2007/1480	VUPEN
66	http://www.vupen.com/english/advisories/2007/1939	VUPEN
67	http://www.vupen.com/english/advisories/2007/1994	VUPEN
68	http://www.vupen.com/english/advisories/2007/2788	VUPEN
69	http://www.vupen.com/english/advisories/2008/0082	VUPEN
70	https://issues.rpath.com/browse/RPL-1231	CONFIRM
71	https://issues.rpath.com/browse/RPL-1232	CONFIRM
72	https://issues.rpath.com/browse/RPL-1424	CONFIRM
73	https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9782	OVAL

共通脆弱性一覧