| Name | CVE-2007-1558 |
| Description | The APOP protocol allows remote attackers to guess the first 3 characters of a password via man-in-the-middle (MITM) attacks that use crafted message IDs and MD5 collisions. NOTE: this design-level issue potentially affects all products that use APOP, including (1) Thunderbird 1.x before 1.5.0.12 and 2.x before 2.0.0.4, (2) Evolution, (3) mutt, (4) fetchmail before 6.3.8, (5) SeaMonkey 1.0.x before 1.0.9 and 1.1.x before 1.1.2, (6) Balsa 2.3.16 and earlier, (7) Mailfilter before 0.8.2, and possibly other products. |
| Source | CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more) |
| References | DSA-1300-1, DSA-1305-1, DTSA-46-1, DTSA-47-1 |
The table below lists information on source packages.
| Source Package | Release | Version | Status |
|---|---|---|---|
| balsa (PTS) | jessie | 2.4.12-1 | fixed |
| stretch | 2.4.12-3 | fixed | |
| buster | 2.5.6-2+deb10u1 | fixed | |
| bullseye | 2.6.1-1 | fixed | |
| sid, trixie, bookworm | 2.6.4-2 | fixed | |
| claws-mail (PTS) | jessie, jessie (lts) | 3.11.1-3+deb8u1 | fixed |
| stretch | 3.14.1-3 | fixed | |
| buster | 3.17.3-2 | fixed | |
| bullseye | 3.17.8-1 | fixed | |
| bookworm | 4.1.1-2 | fixed | |
| sid, trixie | 4.2.0-2 | fixed | |
| fetchmail (PTS) | jessie | 6.3.26-1 | fixed |
| stretch | 6.3.26-3 | fixed | |
| buster | 6.4.0~beta4-3+deb10u1 | fixed | |
| bullseye | 6.4.16-4+deb11u1 | fixed | |
| bookworm | 6.4.37-1 | fixed | |
| sid, trixie | 6.4.38-1 | fixed | |
| icedove (PTS) | jessie | 1:52.3.0-4~deb8u2 | fixed |
| mailfilter (PTS) | jessie | 0.8.3-1 | fixed |
| stretch | 0.8.6-2 | fixed | |
| buster | 0.8.6-3 | fixed | |
| bullseye | 0.8.7-1 | fixed | |
| sid, trixie, bookworm | 0.8.9-1 | fixed | |
| mutt (PTS) | jessie, jessie (lts) | 1.5.23-3+deb8u7 | fixed |
| stretch (security) | 1.7.2-1+deb9u6 | fixed | |
| stretch (lts), stretch | 1.7.2-1+deb9u7 | fixed | |
| buster | 1.10.1-2.1+deb10u6 | fixed | |
| buster (security) | 1.10.1-2.1+deb10u7 | fixed | |
| bullseye (security), bullseye | 2.0.5-4.1+deb11u3 | fixed | |
| bookworm | 2.2.12-0.1~deb12u1 | fixed | |
| bookworm (security) | 2.2.9-1+deb12u1 | fixed | |
| sid, trixie | 2.2.12-0.1 | fixed |
The information below is based on the following data on fixed versions.
| Package | Type | Release | Fixed Version | Urgency | Origin | Debian Bugs |
|---|---|---|---|---|---|---|
| balsa | source | (unstable) | 2.3.17-1 | unimportant | ||
| claws-mail | source | (unstable) | 2.9.1-1 | unimportant | ||
| fetchmail | source | etch | 6.3.6-1etch3 | |||
| fetchmail | source | (unstable) | 6.3.8-1 | unimportant | ||
| iceape | source | etch | 1.0.9-0etch1 | DSA-1300-1 | ||
| iceape | source | lenny | 1.0.10~pre070720-0etch1+lenny1 | DTSA-47-1 | ||
| iceape | source | (unstable) | 1.1.2-1 | |||
| icedove | source | etch | 1.5.0.12.dfsg1-0etch1 | DSA-1305-1 | ||
| icedove | source | lenny | 1.5.0.12.dfsg1-0etch1+lenny1 | DTSA-46-1 | ||
| icedove | source | (unstable) | 2.0.0.4-1 | |||
| mailfilter | source | (unstable) | 0.8.2-1 | unimportant | ||
| mutt | source | (unstable) | 1.5.18-6 | unimportant |
Affects various clients, but no practical security implications
MFSA2007-15
i couldn't pinpoint exact mutt fixed version, but lenny's version has the
patch and etch's version does not (http://dev.mutt.org/trac/ticket/2846)