The S/MIME specification allows a Cipher Block Chaining (CBC) malleability-gadget attack that can indirectly lead to plaintext exfiltration, aka EFAIL.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched.

  - S/MIME: CBC gadget attacks allows to exfiltrate plaintext out of encrypted emails (CVE-2017-17689)

Note that Nessus has not tested for this issue but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched.

  - S/MIME: CBC gadget attacks allows to exfiltrate plaintext out of encrypted emails (CVE-2017-17689)

Note that Nessus has not tested for this issue but has instead relied on the package manager's report that the package is installed.

This update for enigmail to version 2.0.5 fixes the following issues :

Improvements on previous fixes on CVE-2017-17688, boo#1093151 and CVE-2017-17689, boo#1093152 (EFAIL) :

  - do not decrypt MIME parts unnecessarily 

  - improve Error Message for Missing Message Modification     Code

This update for enigmail fixes multiple issues.

Security issues fixed :

  - CVE-2017-17688: CFB gadget attacks allowed to exfiltrate     plaintext out of encrypted emails. enigmail now fails on     GnuPG integrity check warnings for old Algorithms     (bsc#1093151)

  - CVE-2017-17689: CBC gadget attacks allows to exfiltrate     plaintext out of encrypted emails (bsc#1093152)

This update for enigmail to version 2.0.4 fixes multiple issues.

Security issues fixed :

  - CVE-2017-17688: CFB gadget attacks allowed to exfiltrate     plaintext out of encrypted emails. enigmail now fails on     GnuPG integrity check warnings for old Algorithms     (bsc#1093151)

  - CVE-2017-17689: CBC gadget attacks allows to exfiltrate     plaintext out of encrypted emails (bsc#1093152)

This update also includes new and updated functionality :

  - The Encryption and Signing buttons now work for both     OpenPGP and S/MIME. Enigmail will chose between S/MIME     or OpenPGP depending on whether the keys for all     recipients are available for the respective standard

  - Support for the Autocrypt standard, which is now enabled     by default

  - Support for Pretty Easy Privacy (p&equiv;p)

  - Support for Web Key Directory (WKD)

  - The message subject can now be encrypted and replaced     with a dummy subject, following the Memory Hole standard     forprotected Email Headers

  - keys on keyring are automatically refreshed from     keyservers at irregular intervals

  - Subsequent updates of Enigmail no longer require a     restart of Thunderbird 

  - Keys are internally addressed using the fingerprint     instead of the key ID

ID	Name	Product	Family	Severity
196333	RHEL 6 : s_mime (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	medium
196309	RHEL 7 : s_mime (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	medium
123173	openSUSE Security Update : enigmail (openSUSE-2019-395) (EFAIL)	Nessus	SuSE Local Security Checks	medium
123172	openSUSE Security Update : enigmail (openSUSE-2019-368) (EFAIL)	Nessus	SuSE Local Security Checks	medium
110068	openSUSE Security Update : enigmail (openSUSE-2018-495) (EFAIL)	Nessus	SuSE Local Security Checks	medium
109933	openSUSE Security Update : enigmail (openSUSE-2018-474) (EFAIL)	Nessus	SuSE Local Security Checks	medium
109904	openSUSE Security Update : enigmail (openSUSE-2018-470) (EFAIL)	Nessus	SuSE Local Security Checks	medium

Detections

Analytics

CVE-2017-17689

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium