The S/MIME specification allows a Cipher Block Chaining (CBC) malleability-gadget attack that can indirectly lead to plaintext exfiltration, aka EFAIL.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The S/MIME specification allows a Cipher Block Chaining (CBC) malleability-gadget attack that can     indirectly lead to plaintext exfiltration, aka EFAIL. (CVE-2017-17689)

Note that Nessus relies on the presence of the package as reported by the vendor.

This update for enigmail to version 2.0.5 fixes the following issues :

Improvements on previous fixes on CVE-2017-17688, boo#1093151 and CVE-2017-17689, boo#1093152 (EFAIL) :

  - do not decrypt MIME parts unnecessarily 

  - improve Error Message for Missing Message Modification     Code

This update for enigmail fixes multiple issues.

Security issues fixed :

  - CVE-2017-17688: CFB gadget attacks allowed to exfiltrate     plaintext out of encrypted emails. enigmail now fails on     GnuPG integrity check warnings for old Algorithms     (bsc#1093151)

  - CVE-2017-17689: CBC gadget attacks allows to exfiltrate     plaintext out of encrypted emails (bsc#1093152)

This update for enigmail to version 2.0.4 fixes multiple issues.

Security issues fixed :

  - CVE-2017-17688: CFB gadget attacks allowed to exfiltrate     plaintext out of encrypted emails. enigmail now fails on     GnuPG integrity check warnings for old Algorithms     (bsc#1093151)

  - CVE-2017-17689: CBC gadget attacks allows to exfiltrate     plaintext out of encrypted emails (bsc#1093152)

This update also includes new and updated functionality :

  - The Encryption and Signing buttons now work for both     OpenPGP and S/MIME. Enigmail will chose between S/MIME     or OpenPGP depending on whether the keys for all     recipients are available for the respective standard

  - Support for the Autocrypt standard, which is now enabled     by default

  - Support for Pretty Easy Privacy (p&equiv;p)

  - Support for Web Key Directory (WKD)

  - The message subject can now be encrypted and replaced     with a dummy subject, following the Memory Hole standard     forprotected Email Headers

  - keys on keyring are automatically refreshed from     keyservers at irregular intervals

  - Subsequent updates of Enigmail no longer require a     restart of Thunderbird 

  - Keys are internally addressed using the fingerprint     instead of the key ID

ID	Name	Product	Family	Severity
220871	Linux Distros Unpatched Vulnerability : CVE-2017-17689	Nessus	Misc.	medium
123173	openSUSE Security Update : enigmail (openSUSE-2019-395) (EFAIL)	Nessus	SuSE Local Security Checks	high
123172	openSUSE Security Update : enigmail (openSUSE-2019-368) (EFAIL)	Nessus	SuSE Local Security Checks	high
110068	openSUSE Security Update : enigmail (openSUSE-2018-495) (EFAIL)	Nessus	SuSE Local Security Checks	high
109933	openSUSE Security Update : enigmail (openSUSE-2018-474) (EFAIL)	Nessus	SuSE Local Security Checks	high
109904	openSUSE Security Update : enigmail (openSUSE-2018-470) (EFAIL)	Nessus	SuSE Local Security Checks	high

Detections

Analytics

CVE-2017-17689

medium

Tenable Plugins

medium

high

high

high

high

high