certfr_avis - certa-2010-avi-208

CERTA-2010-AVI-208

Vulnerability from certfr_avis

Une vulnérabilité dans Cisco IronPort Desktop Flag Plug-in for Outlook provoque l'envoi en clair de messages électroniques censés être chiffrés.

Description

Le module Cisco IronPort Desktop Flag Plug-in for Outlook permet aux utilisateurs de Microsoft Outlook d'envoyer des messages chiffrés via un boîtier Cisco IronPort Encryption Appliance ou Email Security Appliance.

Si plusieurs messages électroniques sont rédigés simultanément et que le bouton Send Secure est utilisé pour l'envoi, alors il se peut que seul le premier de ces messages soit chiffré.

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Cisco IronPort Desktop Flag Plug-in for Outlook versions 6.2.4.3 à 6.5.0-006 (non incluse).

Impacted products

	Vendor	Product	Description

References

Title

Publication Time

Tags

Bulletin de sécurité cisco-sr-20100511-ironport du 11 mai 2010	None	vendor-advisory
Bulletin de sécurité Cisco 20100511-ironport du 11 mai 2010 :	-	other

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [],
  "affected_systems_content": "\u003cP\u003e\u003cSPAN class=\"textit\"\u003eCisco IronPort Desktop Flag Plug-in for  Outlook\u003c/SPAN\u003e versions 6.2.4.3 \u00e0 6.5.0-006 (non incluse).\u003c/P\u003e",
  "content": "## Description\n\nLe module Cisco IronPort Desktop Flag Plug-in for Outlook permet aux\nutilisateurs de Microsoft Outlook d\u0027envoyer des messages chiffr\u00e9s via un\nbo\u00eetier Cisco IronPort Encryption Appliance ou Email Security Appliance.\n\nSi plusieurs messages \u00e9lectroniques sont r\u00e9dig\u00e9s simultan\u00e9ment et que le\nbouton Send Secure est utilis\u00e9 pour l\u0027envoi, alors il se peut que seul\nle premier de ces messages soit chiffr\u00e9.\n\n## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2010-1568",
      "url": "https://www.cve.org/CVERecord?id=CVE-2010-1568"
    }
  ],
  "initial_release_date": "2010-05-12T00:00:00",
  "last_revision_date": "2010-05-12T00:00:00",
  "links": [
    {
      "title": "Bulletin de s\u00e9curit\u00e9 Cisco 20100511-ironport du 11 mai 2010    :",
      "url": "http://www.cisco.com/warp/public/707/cisco-sr-20100511-ironport.shtml"
    }
  ],
  "reference": "CERTA-2010-AVI-208",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2010-05-12T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 dans \u003cspan class=\"textit\"\u003eCisco IronPort Desktop Flag\nPlug-in for Outlook\u003c/span\u003e provoque l\u0027envoi en clair de messages\n\u00e9lectroniques cens\u00e9s \u00eatre chiffr\u00e9s.\n",
  "title": "Vuln\u00e9rabilit\u00e9 dans Cisco IronPort Desktop Flag Plug-in for Outlook",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 cisco-sr-20100511-ironport du 11 mai 2010",
      "url": null
    }
  ]
}

CVE-2010-1568 (GCVE-0-2010-1568)

Vulnerability from cvelistv5

Published

2010-05-14 20:00

Modified

2024-09-17 02:26

Severity ?

CWE

Summary

The Send Secure functionality in the Cisco IronPort Desktop Flag Plug-in for Outlook before 6.5.0-006 does not properly handle simultaneously composed messages, which might allow remote attackers to obtain cleartext contents of e-mail messages that were intended to be encrypted, aka bug 65623.

References

URL

Tags

http://www.cisco.com/en/US/products/products_security_response09186a0080b2c505.html

vendor-advisory, x_refsource_CISCO

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T01:28:42.382Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "20100511 Cisco IronPort Desktop Flag Plug-in for Outlook Information Disclosure",
            "tags": [
              "vendor-advisory",
              "x_refsource_CISCO",
              "x_transferred"
            ],
            "url": "http://www.cisco.com/en/US/products/products_security_response09186a0080b2c505.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Send Secure functionality in the Cisco IronPort Desktop Flag Plug-in for Outlook before 6.5.0-006 does not properly handle simultaneously composed messages, which might allow remote attackers to obtain cleartext contents of e-mail messages that were intended to be encrypted, aka bug 65623."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2010-05-14T20:00:00.000Z",
        "orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
        "shortName": "cisco"
      },
      "references": [
        {
          "name": "20100511 Cisco IronPort Desktop Flag Plug-in for Outlook Information Disclosure",
          "tags": [
            "vendor-advisory",
            "x_refsource_CISCO"
          ],
          "url": "http://www.cisco.com/en/US/products/products_security_response09186a0080b2c505.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "psirt@cisco.com",
          "ID": "CVE-2010-1568",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The Send Secure functionality in the Cisco IronPort Desktop Flag Plug-in for Outlook before 6.5.0-006 does not properly handle simultaneously composed messages, which might allow remote attackers to obtain cleartext contents of e-mail messages that were intended to be encrypted, aka bug 65623."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "20100511 Cisco IronPort Desktop Flag Plug-in for Outlook Information Disclosure",
              "refsource": "CISCO",
              "url": "http://www.cisco.com/en/US/products/products_security_response09186a0080b2c505.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
    "assignerShortName": "cisco",
    "cveId": "CVE-2010-1568",
    "datePublished": "2010-05-14T20:00:00.000Z",
    "dateReserved": "2010-04-27T00:00:00.000Z",
    "dateUpdated": "2024-09-17T02:26:27.566Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

CERTA-2010-AVI-208

Vulnerability from certfr_avis

Description

Solution

CVE-2010-1568 (GCVE-0-2010-1568)

Vulnerability from cvelistv5

Tags

Sightings

Nomenclature