CVE-2007-1558
Summary
| CVE | CVE-2007-1558 |
|---|---|
| State | PUBLISHED |
| Assigner | mitre |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2007-04-16 22:19:00 UTC |
| Updated | 2026-04-23 00:35:47 UTC |
| Description | The APOP protocol allows remote attackers to guess the first 3 characters of a password via man-in-the-middle (MITM) attacks that use crafted message IDs and MD5 collisions. NOTE: this design-level issue potentially affects all products that use APOP, including (1) Thunderbird 1.x before 1.5.0.12 and 2.x before 2.0.0.4, (2) Evolution, (3) mutt, (4) fetchmail before 6.3.8, (5) SeaMonkey 1.0.x before 1.0.9 and 1.1.x before 1.1.2, (6) Balsa 2.3.16 and earlier, (7) Mailfilter before 0.8.2, and possibly other products. |
Risk And Classification
Primary CVSS: v2.0 2.6 from [email protected]
AV:N/AC:H/Au:N/C:P/I:N/A:N
Problem Types: NVD-CWE-Other | n/a
CVSS v2.0 Breakdown
Access Vector
NetworkAccess Complexity
HighAuthentication
NoneConfidentiality
PartialIntegrity
NoneAvailability
NoneAV:N/AC:H/Au:N/C:P/I:N/A:N
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Apop Protocol | Apop Protocol | All | All | All | All |
Vendor Declared Affected Products
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| Debian -- Security Information -- DSA-1300-1 iceape | af854a3a-2127-422b-91ae-364da2661108 | www.debian.org | |
| Support | af854a3a-2127-422b-91ae-364da2661108 | www.redhat.com | |
| patches.sgi.com/support/free/security/advisories/20070602-01-P.asc | af854a3a-2127-422b-91ae-364da2661108 | patches.sgi.com | |
| The Slackware Linux Project: Slackware Security Advisories | af854a3a-2127-422b-91ae-364da2661108 | slackware.com | |
| USN-469-1: Thunderbird vulnerabilities | Ubuntu | af854a3a-2127-422b-91ae-364da2661108 | www.ubuntu.com | |
| rPath update for firefox and thunderbird - Advisories - Secunia | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | |
| rhn.redhat.com | Red Hat Support | af854a3a-2127-422b-91ae-364da2661108 | www.redhat.com | |
| www.trustix.org/errata/2007/0024 | af854a3a-2127-422b-91ae-364da2661108 | www.trustix.org | |
| Advisories - Mandriva Linux | af854a3a-2127-422b-91ae-364da2661108 | www.mandriva.com | |
| Claws Mail - the email client that bites! | af854a3a-2127-422b-91ae-364da2661108 | www.claws-mail.org | |
| Support | af854a3a-2127-422b-91ae-364da2661108 | www.redhat.com | |
| ANNOUNCE: balsa-2.3.17 released | af854a3a-2127-422b-91ae-364da2661108 | mail.gnome.org | |
| Webmail - OVH | af854a3a-2127-422b-91ae-364da2661108 | www.vupen.com | |
| SecurityFocus | af854a3a-2127-422b-91ae-364da2661108 | www.securityfocus.com | |
| Slackware update for Mozilla products - Secunia Advisories - Vulnerability Intelligence - Secunia.com | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | |
| Red Hat update for mutt - Advisories - Secunia | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | Vendor Advisory |
| Support | af854a3a-2127-422b-91ae-364da2661108 | www.redhat.com | |
| SecurityFocus | af854a3a-2127-422b-91ae-364da2661108 | www.securityfocus.com | |
| About Security Update 2007-005 | af854a3a-2127-422b-91ae-364da2661108 | docs.info.apple.com | |
| Webmail- OVH | af854a3a-2127-422b-91ae-364da2661108 | www.vupen.com | |
| APOP Protocol Insecure MD5 Hash Weakness | af854a3a-2127-422b-91ae-364da2661108 | www.securityfocus.com | Patch |
| Webmail - OVH | af854a3a-2127-422b-91ae-364da2661108 | www.vupen.com | |
| Advisories - Mandriva Linux | af854a3a-2127-422b-91ae-364da2661108 | www.mandriva.com | |
| Webmail - OVH | af854a3a-2127-422b-91ae-364da2661108 | www.vupen.com | |
| MFSA 2007-15: Security Vulnerability in APOP Authentication | af854a3a-2127-422b-91ae-364da2661108 | www.mozilla.org | Patch, Vendor Advisory |
| Ubuntu update for mozilla-thunderbird - Secunia Advisories - Vulnerability Intelligence - Secunia.com | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | Vendor Advisory |
| Fetchmail - Kostenloser Open Source Mail Daemon | af854a3a-2127-422b-91ae-364da2661108 | fetchmail.berlios.de | |
| rPath update for mutt - Secunia Advisories - Vulnerability Intelligence - Secunia.com | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | Vendor Advisory |
| SGI Advanced Linux Environment Multiple Updates - Advisories - Secunia | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | |
| Debian -- Security Information -- DSA-1305-1 icedove | af854a3a-2127-422b-91ae-364da2661108 | www.debian.org | Patch |
| www.securityfocus.com/archive/1/464569/100/0/threaded | af854a3a-2127-422b-91ae-364da2661108 | www.securityfocus.com | |
| Webmail : Solution de messagerie professionnelle - OVHcloud- OVH | af854a3a-2127-422b-91ae-364da2661108 | www.vupen.com | |
| Repository / Oval Repository | af854a3a-2127-422b-91ae-364da2661108 | oval.cisecurity.org | |
| Security Announcement | af854a3a-2127-422b-91ae-364da2661108 | www.novell.com | |
| Security Announcement | af854a3a-2127-422b-91ae-364da2661108 | www.novell.com | |
| SUSE updates for Mozilla Products - Advisories - Secunia | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | |
| Advisories - Mandriva Linux | af854a3a-2127-422b-91ae-364da2661108 | www.mandriva.com | |
| Red Hat update for ruby - Secunia Advisories - Vulnerability Information - Secunia.com | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | |
| Webmail - OVH | af854a3a-2127-422b-91ae-364da2661108 | www.vupen.com | |
| Advisories - Mandriva Linux | af854a3a-2127-422b-91ae-364da2661108 | www.mandriva.com | |
| Support | af854a3a-2127-422b-91ae-364da2661108 | www.redhat.com | |
| HPSBUX02153 SSRT061181 rev.7 - HP-UX Running Firefox, Remote Unauthorized Access or Elevation of Privileges or Denial of Service (DoS) - c00771742 - HP Business Support Center | af854a3a-2127-422b-91ae-364da2661108 | h20000.www2.hp.com | |
| issues.rpath.com/browse/RPL-1231 | af854a3a-2127-422b-91ae-364da2661108 | issues.rpath.com | |
| www.trustix.org/errata/2007/0019 | af854a3a-2127-422b-91ae-364da2661108 | www.trustix.org | |
| h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp | af854a3a-2127-422b-91ae-364da2661108 | h20000.www2.hp.com | |
| Debian update for iceape - Secunia Advisories - Vulnerability Intelligence - Secunia.com | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | |
| Webmail : Solution de messagerie professionnelle - OVHcloud- OVH | af854a3a-2127-422b-91ae-364da2661108 | www.vupen.com | |
| US-CERT Technical Cyber Security Alert TA07-151A -- Mozilla Updates for Multiple Vulnerabilities | af854a3a-2127-422b-91ae-364da2661108 | www.us-cert.gov | US Government Resource |
| Gentoo updates for Mozilla Products - Advisories - Secunia | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | |
| Sylpheed - lightweight and user-friendly e-mail client | af854a3a-2127-422b-91ae-364da2661108 | sylpheed.sraoss.jp | |
| APPLE-SA-2007-05-24 Security Update 2007-005 | af854a3a-2127-422b-91ae-364da2661108 | lists.apple.com | |
| oss-security - mailfilter 0.8.2 fixes CVE-2007-1558 (APOP) | af854a3a-2127-422b-91ae-364da2661108 | www.openwall.com | |
| rPath update for evolution-data-server - Advisories - Secunia | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | |
| Trustix Updates for Multiple Packages - Advisories - Secunia | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | |
| Support | af854a3a-2127-422b-91ae-364da2661108 | www.redhat.com | |
| Gentoo Linux Documentation -- Mozilla products: Multiple vulnerabilities | af854a3a-2127-422b-91ae-364da2661108 | security.gentoo.org | |
| Webmail : Solution de messagerie professionnelle - OVHcloud- OVH | af854a3a-2127-422b-91ae-364da2661108 | www.vupen.com | |
| Support | af854a3a-2127-422b-91ae-364da2661108 | www.redhat.com | |
| SecurityFocus | af854a3a-2127-422b-91ae-364da2661108 | www.securityfocus.com | Vendor Advisory |
| Trustix Update for Multiple Packages - Advisories - Secunia | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | |
| SecurityTracker.com Archives - Fetchmail APOP Authentication Weakness May Let Remote Users Determine the APOP Secret | af854a3a-2127-422b-91ae-364da2661108 | www.securitytracker.com | |
| SecurityFocus | af854a3a-2127-422b-91ae-364da2661108 | www.securityfocus.com | |
| Debian update for icedove - Advisories - Secunia | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | |
| issues.rpath.com/browse/RPL-1232 | af854a3a-2127-422b-91ae-364da2661108 | issues.rpath.com | |
| USN-520-1: fetchmail vulnerabilities | Ubuntu | af854a3a-2127-422b-91ae-364da2661108 | www.ubuntu.com | |
| SourceForge.net: News: mpop 1.0.9 released! | af854a3a-2127-422b-91ae-364da2661108 | sourceforge.net | |
| SUSE Update for Multiple Packages - Advisories - Secunia | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | |
| Apple Mac OS X Security Update for Multiple Vulnerabilities - Advisories - Secunia | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | Vendor Advisory |
| issues.rpath.com/browse/RPL-1424 | af854a3a-2127-422b-91ae-364da2661108 | issues.rpath.com | |
| SecurityFocus | af854a3a-2127-422b-91ae-364da2661108 | www.securityfocus.com | |
| oss-security - Re: CVE-2007-1558 update (was: mailfilter 0.8.2 fixes CVE-2007-1558 (APOP)) | af854a3a-2127-422b-91ae-364da2661108 | www.openwall.com | |
| Balsa - Download | af854a3a-2127-422b-91ae-364da2661108 | balsa.gnome.org | |
| Advisories - Mandriva Linux | af854a3a-2127-422b-91ae-364da2661108 | www.mandriva.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.