Enigmail 1.7.x before 1.7.2 sends emails in plaintext when encryption is enabled and only BCC recipients are specified, which allows remote attackers to obtain sensitive information by sniffing the network.

The remote host is affected by the vulnerability described in GLSA-201504-01 (Mozilla Products: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Firefox, Thunderbird,       and SeaMonkey. Please review the CVE identifiers referenced below for       details.
  Impact :

    A remote attacker could entice a user to view a specially crafted web       page or email, possibly resulting in execution of arbitrary code or a       Denial of Service condition. Furthermore, a remote attacker may be able       to perform Man-in-the-Middle attacks, obtain sensitive information, spoof       the address bar, conduct clickjacking attacks, bypass security       restrictions and protection mechanisms,  or have other unspecified       impact.
  Workaround :

    There are no known workarounds at this time.

Upstream annoncement :

  - This is a bugfix release, fixing several major issues     found in v1.7.

    - A security bug (CVE-2014-5369) has been fixed.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

enigmail was updated to version 1.7.2 (bnc#893330)

  - bugfix release which contains several bugfixes including     mail with only Bcc recipients sent in plain text     (CVE-2014-5369)

ID	Name	Product	Family	Severity
82632	GLSA-201504-01 : Mozilla Products: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
77800	Fedora 21 : thunderbird-enigmail-1.7.2-1.fc21 (2014-9919)	Nessus	Fedora Local Security Checks	medium
77595	Fedora 19 : thunderbird-enigmail-1.7.2-1.fc19 (2014-9954)	Nessus	Fedora Local Security Checks	medium
77594	Fedora 20 : thunderbird-enigmail-1.7.2-1.fc20 (2014-9944)	Nessus	Fedora Local Security Checks	medium
77565	openSUSE Security Update : enigmail (openSUSE-SU-2014:1096-1)	Nessus	SuSE Local Security Checks	medium

Detections

Analytics

CVE-2014-5369

high

Tenable Plugins

critical

medium

medium

medium

medium