Test ID:	1.3.6.1.4.1.25623.1.0.55715
Category:	Ubuntu Local Security Checks
Title:	Ubuntu USN-211-1 (enigmail)
Summary:	NOSUMMARY
Description:	Description: The remote host is missing an update to enigmail announced via advisory USN-211-1. A security issue affects the following Ubuntu releases: Ubuntu 4.10 (Warty Warthog) Ubuntu 5.04 (Hoary Hedgehog) Ubuntu 5.10 (Breezy Badger) The following packages are affected: mozilla-enigmail mozilla-thunderbird-enigmail Hadmut Danish discovered an information disclosure vulnerability in the key selection dialog of the Mozilla/Thunderbird enigmail plugin. If a user's keyring contained a key with an empty user id (i. e. a key without a name and email address), this key was selected by default when the user attempted to send an encrypted email. Unless this empty key was manually deselected, the message got encrypted for that empty key, whose owner could then decrypt it. Solution: The problem can be corrected by upgrading the affected package to version 2:0.92.1-0ubuntu04.10 (for Ubuntu 4.10), 2:0.92.1-0ubuntu05.04 (for Ubuntu 5.04), or 2:0.92.1-0ubuntu05.10 (for Ubuntu 5.10). You need to restart Thunderbird and Mozilla Mail after a standard system upgrade to effect the necessary changes. http://www.securityspace.com/smysecure/catid.html?in=USN-211-1 Risk factor : Medium CVSS Score: 5.0
Cross-Ref:	BugTraq ID: 15155 Common Vulnerability Exposure (CVE) ID: CVE-2005-3256 http://www.securityfocus.com/bid/15155 CERT/CC vulnerability note: VU#805121 http://www.kb.cert.org/vuls/id/805121 Debian Security Information: DSA-889 (Google Search) http://www.debian.org/security/2005/dsa-889 http://www.mandriva.com/security/advisories?name=MDKSA-2005:226 SuSE Security Announcement: SUSE-SR:2005:028 (Google Search) http://www.novell.com/linux/security/advisories/2005_28_sr.html https://usn.ubuntu.com/211-1/ http://www.vupen.com/english/advisories/2005/2158
Copyright	Copyright (c) 2005 E-Soft Inc. http://www.securityspace.com

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.