CVE-2007-1558

Published: Apr 16, 2007Modified: Apr 23, 2026

2.6

Vector

AV:N/AC:H/Au:N/C:P/I:N/A:N

Exploitability: 4.9 / Impact: 2.9

Source: NVD

Description

The APOP protocol allows remote attackers to guess the first 3 characters of a password via man-in-the-middle (MITM) attacks that use crafted message IDs and MD5 collisions. NOTE: this design-level issue potentially affects all products that use APOP, including (1) Thunderbird 1.x before 1.5.0.12 and 2.x before 2.0.0.4, (2) Evolution, (3) mutt, (4) fetchmail before 6.3.8, (5) SeaMonkey 1.0.x before 1.0.9 and 1.1.x before 1.1.2, (6) Balsa 2.3.16 and earlier, (7) Mailfilter before 0.8.2, and possibly other products.

Affected (1)

Products: Apop Protocol: Apop Protocol

Apop Protocol

1 product

Apop Protocol

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Apop Protocol Apop Protocol	All versions

References (146)

ftp://patches.sgi.com/support/free/security/advisories/20070602-01-P.asc (unsafe URL)

Source: cve@mitre.org

http://balsa.gnome.org/download.html

Source: cve@mitre.org

http://docs.info.apple.com/article.html?artnum=305530

Source: cve@mitre.org

http://fetchmail.berlios.de/fetchmail-SA-2007-01.txt

Source: cve@mitre.org

http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00771742

Source: cve@mitre.org

http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00774579

Source: cve@mitre.org

http://lists.apple.com/archives/security-announce/2007/May/msg00004.html

Source: cve@mitre.org

http://mail.gnome.org/archives/balsa-list/2007-July/msg00000.html

Source: cve@mitre.org

http://secunia.com/advisories/25353

Source: cve@mitre.org

http://secunia.com/advisories/25402

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/25476

Source: cve@mitre.org

http://secunia.com/advisories/25496

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/25529

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/25534

Source: cve@mitre.org

http://secunia.com/advisories/25546

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/25559

Source: cve@mitre.org

http://secunia.com/advisories/25664

Source: cve@mitre.org

http://secunia.com/advisories/25750

Source: cve@mitre.org

http://secunia.com/advisories/25798

Source: cve@mitre.org

http://secunia.com/advisories/25858

Source: cve@mitre.org

http://secunia.com/advisories/25894

Source: cve@mitre.org

http://secunia.com/advisories/26083

Source: cve@mitre.org

http://secunia.com/advisories/26415

Source: cve@mitre.org

http://secunia.com/advisories/35699

Source: cve@mitre.org

http://security.gentoo.org/glsa/glsa-200706-06.xml

Source: cve@mitre.org

http://slackware.com/security/viewer.php?l=slackware-security&y=2007&m=slackware-security.571857

Source: cve@mitre.org

http://sourceforge.net/forum/forum.php?forum_id=683706

Source: cve@mitre.org

http://sylpheed.sraoss.jp/en/news.html

Source: cve@mitre.org

http://www.claws-mail.org/news.php

Source: cve@mitre.org

http://www.debian.org/security/2007/dsa-1300

Source: cve@mitre.org

http://www.debian.org/security/2007/dsa-1305

Source: cve@mitre.org

Patch

http://www.mandriva.com/security/advisories?name=MDKSA-2007:105

Source: cve@mitre.org

http://www.mandriva.com/security/advisories?name=MDKSA-2007:107

Source: cve@mitre.org

http://www.mandriva.com/security/advisories?name=MDKSA-2007:113

Source: cve@mitre.org

http://www.mandriva.com/security/advisories?name=MDKSA-2007:119

Source: cve@mitre.org

http://www.mandriva.com/security/advisories?name=MDKSA-2007:131

Source: cve@mitre.org

http://www.mozilla.org/security/announce/2007/mfsa2007-15.html

Source: cve@mitre.org

PatchVendor Advisory

http://www.novell.com/linux/security/advisories/2007_14_sr.html

Source: cve@mitre.org

http://www.novell.com/linux/security/advisories/2007_36_mozilla.html

Source: cve@mitre.org

http://www.openwall.com/lists/oss-security/2009/08/15/1

Source: cve@mitre.org

http://www.openwall.com/lists/oss-security/2009/08/18/1

Source: cve@mitre.org

http://www.redhat.com/support/errata/RHSA-2007-0344.html

Source: cve@mitre.org

http://www.redhat.com/support/errata/RHSA-2007-0353.html

Source: cve@mitre.org

http://www.redhat.com/support/errata/RHSA-2007-0385.html

Source: cve@mitre.org

http://www.redhat.com/support/errata/RHSA-2007-0386.html

Source: cve@mitre.org

http://www.redhat.com/support/errata/RHSA-2007-0401.html

Source: cve@mitre.org

http://www.redhat.com/support/errata/RHSA-2007-0402.html

Source: cve@mitre.org

http://www.redhat.com/support/errata/RHSA-2009-1140.html

Source: cve@mitre.org

http://www.securityfocus.com/archive/1/464477/30/0/threaded

Source: cve@mitre.org

Vendor Advisory

http://www.securityfocus.com/archive/1/464569/100/0/threaded

Source: cve@mitre.org

http://www.securityfocus.com/archive/1/470172/100/200/threaded

Source: cve@mitre.org

http://www.securityfocus.com/archive/1/471455/100/0/threaded

Source: cve@mitre.org

http://www.securityfocus.com/archive/1/471720/100/0/threaded

Source: cve@mitre.org

http://www.securityfocus.com/archive/1/471842/100/0/threaded

Source: cve@mitre.org

http://www.securityfocus.com/bid/23257

Source: cve@mitre.org

Patch

http://www.securitytracker.com/id?1018008

Source: cve@mitre.org

http://www.trustix.org/errata/2007/0019/

Source: cve@mitre.org

http://www.trustix.org/errata/2007/0024/

Source: cve@mitre.org

http://www.ubuntu.com/usn/usn-469-1

Source: cve@mitre.org

http://www.ubuntu.com/usn/usn-520-1

Source: cve@mitre.org

http://www.us-cert.gov/cas/techalerts/TA07-151A.html

Source: cve@mitre.org

US Government Resource

http://www.vupen.com/english/advisories/2007/1466

Source: cve@mitre.org

http://www.vupen.com/english/advisories/2007/1467

Source: cve@mitre.org

http://www.vupen.com/english/advisories/2007/1468

Source: cve@mitre.org

http://www.vupen.com/english/advisories/2007/1480

Source: cve@mitre.org

http://www.vupen.com/english/advisories/2007/1939

Source: cve@mitre.org

http://www.vupen.com/english/advisories/2007/1994

Source: cve@mitre.org

http://www.vupen.com/english/advisories/2007/2788

Source: cve@mitre.org

http://www.vupen.com/english/advisories/2008/0082

Source: cve@mitre.org

https://issues.rpath.com/browse/RPL-1231

Source: cve@mitre.org

https://issues.rpath.com/browse/RPL-1232

Source: cve@mitre.org

https://issues.rpath.com/browse/RPL-1424

Source: cve@mitre.org

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9782

Source: cve@mitre.org

ftp://patches.sgi.com/support/free/security/advisories/20070602-01-P.asc (unsafe URL)