Vulnerability-Lookup

CERTA-2010-AVI-208

Vulnerability from certfr_avis - Published: 2010-05-12 - Updated: 2010-05-12

Une vulnérabilité dans Cisco IronPort Desktop Flag Plug-in for Outlook provoque l'envoi en clair de messages électroniques censés être chiffrés.

Description

Le module Cisco IronPort Desktop Flag Plug-in for Outlook permet aux utilisateurs de Microsoft Outlook d'envoyer des messages chiffrés via un boîtier Cisco IronPort Encryption Appliance ou Email Security Appliance.

Si plusieurs messages électroniques sont rédigés simultanément et que le bouton Send Secure est utilisé pour l'envoi, alors il se peut que seul le premier de ces messages soit chiffré.

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Cisco IronPort Desktop Flag Plug-in for Outlook versions 6.2.4.3 à 6.5.0-006 (non incluse).

Impacted products

	Vendor	Product	Description

References

Title

Publication Time

Tags

Bulletin de sécurité cisco-sr-20100511-ironport du 11 mai 2010	None	vendor-advisory
Bulletin de sécurité Cisco 20100511-ironport du 11 mai 2010 :	-	other

Show details on source website

JSON

To clipboard Create KEV Entry

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [],
  "affected_systems_content": "\u003cP\u003e\u003cSPAN class=\"textit\"\u003eCisco IronPort Desktop Flag Plug-in for  Outlook\u003c/SPAN\u003e versions 6.2.4.3 \u00e0 6.5.0-006 (non incluse).\u003c/P\u003e",
  "content": "## Description\n\nLe module Cisco IronPort Desktop Flag Plug-in for Outlook permet aux\nutilisateurs de Microsoft Outlook d\u0027envoyer des messages chiffr\u00e9s via un\nbo\u00eetier Cisco IronPort Encryption Appliance ou Email Security Appliance.\n\nSi plusieurs messages \u00e9lectroniques sont r\u00e9dig\u00e9s simultan\u00e9ment et que le\nbouton Send Secure est utilis\u00e9 pour l\u0027envoi, alors il se peut que seul\nle premier de ces messages soit chiffr\u00e9.\n\n## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2010-1568",
      "url": "https://www.cve.org/CVERecord?id=CVE-2010-1568"
    }
  ],
  "initial_release_date": "2010-05-12T00:00:00",
  "last_revision_date": "2010-05-12T00:00:00",
  "links": [
    {
      "title": "Bulletin de s\u00e9curit\u00e9 Cisco 20100511-ironport du 11 mai 2010    :",
      "url": "http://www.cisco.com/warp/public/707/cisco-sr-20100511-ironport.shtml"
    }
  ],
  "reference": "CERTA-2010-AVI-208",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2010-05-12T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 dans \u003cspan class=\"textit\"\u003eCisco IronPort Desktop Flag\nPlug-in for Outlook\u003c/span\u003e provoque l\u0027envoi en clair de messages\n\u00e9lectroniques cens\u00e9s \u00eatre chiffr\u00e9s.\n",
  "title": "Vuln\u00e9rabilit\u00e9 dans Cisco IronPort Desktop Flag Plug-in for Outlook",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 cisco-sr-20100511-ironport du 11 mai 2010",
      "url": null
    }
  ]
}

CVE-2010-1568 (GCVE-0-2010-1568)

Vulnerability from cvelistv5 – Published: 2010-05-14 20:00 – Updated: 2024-09-17 02:26

Summary

The Send Secure functionality in the Cisco IronPort Desktop Flag Plug-in for Outlook before 6.5.0-006 does not properly handle simultaneously composed messages, which might allow remote attackers to obtain cleartext contents of e-mail messages that were intended to be encrypted, aka bug 65623.

Severity ?

No CVSS data available.

CWE

Assigner

cisco

References

URL

Tags

http://www.cisco.com/en/US/products/products_secu…

vendor-advisoryx_refsource_CISCO

Show details on NVD website

JSON

To clipboard Create KEV Entry

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T01:28:42.382Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "20100511 Cisco IronPort Desktop Flag Plug-in for Outlook Information Disclosure",
            "tags": [
              "vendor-advisory",
              "x_refsource_CISCO",
              "x_transferred"
            ],
            "url": "http://www.cisco.com/en/US/products/products_security_response09186a0080b2c505.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Send Secure functionality in the Cisco IronPort Desktop Flag Plug-in for Outlook before 6.5.0-006 does not properly handle simultaneously composed messages, which might allow remote attackers to obtain cleartext contents of e-mail messages that were intended to be encrypted, aka bug 65623."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2010-05-14T20:00:00Z",
        "orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
        "shortName": "cisco"
      },
      "references": [
        {
          "name": "20100511 Cisco IronPort Desktop Flag Plug-in for Outlook Information Disclosure",
          "tags": [
            "vendor-advisory",
            "x_refsource_CISCO"
          ],
          "url": "http://www.cisco.com/en/US/products/products_security_response09186a0080b2c505.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "psirt@cisco.com",
          "ID": "CVE-2010-1568",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The Send Secure functionality in the Cisco IronPort Desktop Flag Plug-in for Outlook before 6.5.0-006 does not properly handle simultaneously composed messages, which might allow remote attackers to obtain cleartext contents of e-mail messages that were intended to be encrypted, aka bug 65623."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "20100511 Cisco IronPort Desktop Flag Plug-in for Outlook Information Disclosure",
              "refsource": "CISCO",
              "url": "http://www.cisco.com/en/US/products/products_security_response09186a0080b2c505.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
    "assignerShortName": "cisco",
    "cveId": "CVE-2010-1568",
    "datePublished": "2010-05-14T20:00:00Z",
    "dateReserved": "2010-04-27T00:00:00Z",
    "dateUpdated": "2024-09-17T02:26:27.566Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CERTA-2010-AVI-208

Description

Solution

CVE-2010-1568 (GCVE-0-2010-1568)

Tags

Sightings

Nomenclature