Mutt PGP/GnuPG Verified Email Signature Spoofing Vulnerability
BID:10929
Info
Mutt PGP/GnuPG Verified Email Signature Spoofing Vulnerability
| Bugtraq ID: | 10929 |
| Class: | Design Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Oct 24 2001 12:00AM |
| Updated: | Oct 24 2001 12:00AM |
| Credit: | Ademar de Souza Reis Jr. <[email protected]> disclosed this vulnerability in 2001. Jan Minar <[email protected]> posted further information in 2004. |
| Vulnerable: |
Mutt Mutt 1.5.6 Mutt Mutt 1.3.28 |
| Not Vulnerable: | |
Discussion
Mutt PGP/GnuPG Verified Email Signature Spoofing Vulnerability
It is reported that Mutt contains a vulnerability that allows attackers to send email that spoofs the look of a successfully verified PGP/GnuPG email message.
An attacker may potentially simulate the look of the PGP/GnuPG output that Mutt usually includes when processing signed email messages. If a user employs Mutt with a specific configuration, the attacker may make email messages look almost identical to a properly signed and verified email.
This may allow an attacker to create a message that falsifies a correctly verified PGP/GnuPG signature. This could allow an attacker to spoof email from trusted sources. This will likely greatly increase the effectiveness of social engineering attacks.
In the index mode, messages with signatures have the 's' flag. Verified signatures change to 'S'. Ensuring that messages have the proper attributes will aid in the mitigation of this vulnerability. Malicious messages can also add the 's' attribute to messages, but not the 'S' after PGP/GnuPG verification.
Versions 1.3.28 and 1.5.6 are reported affected by this vulnerability. Other versions are also likely affected.
It is reported that Mutt contains a vulnerability that allows attackers to send email that spoofs the look of a successfully verified PGP/GnuPG email message.
An attacker may potentially simulate the look of the PGP/GnuPG output that Mutt usually includes when processing signed email messages. If a user employs Mutt with a specific configuration, the attacker may make email messages look almost identical to a properly signed and verified email.
This may allow an attacker to create a message that falsifies a correctly verified PGP/GnuPG signature. This could allow an attacker to spoof email from trusted sources. This will likely greatly increase the effectiveness of social engineering attacks.
In the index mode, messages with signatures have the 's' flag. Verified signatures change to 'S'. Ensuring that messages have the proper attributes will aid in the mitigation of this vulnerability. Malicious messages can also add the 's' attribute to messages, but not the 'S' after PGP/GnuPG verification.
Versions 1.3.28 and 1.5.6 are reported affected by this vulnerability. Other versions are also likely affected.
Exploit / POC
Mutt PGP/GnuPG Verified Email Signature Spoofing Vulnerability
An exploit is not required.
An exploit is not required.
Solution / Fix
Mutt PGP/GnuPG Verified Email Signature Spoofing Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
References
Mutt PGP/GnuPG Verified Email Signature Spoofing Vulnerability
References:
References:
- Mutt Homepage (Mutt)
- PGP sign highlight on mutt (Ademar de Souza Reis Jr.
- PGP sign verification (Ademar de Souza Reis Jr.