|
[Japanese]
|
JVNDB-2004-000590
|
Becky! Internet Mail vulnerability in S/MIME signature verification
|
|
Becky! Internet Mail contains the following vulnerabilities in the S/MIME signature verification:
- S/MIME signature verification does not verify the certification path.
- S/MIME signature verification does not verify the certification expiration date.
|
|
Base Metrics:
5.0 (Medium)
[IPA Score]
- Access Vector: Network
- Access Complexity: Low
- Authentication: None
- Confidentiality Impact: None
- Integrity Impact: Partial
- Availability Impact: None
|
|
|
|
RIMARTS
- Becky! Internet Mail Ver.1.03 and ealier
|
|
|
Even if a recipient receives an email message signed with an S/MIME signature containing a certificate forging an arbitrary email address signed by a self-signed certificate, the recipient may not notice that it is a forged email.
|
|
|
|
RIMARTS
|
|
|
|
|
|
- JVN : JVN#7C9208F1
|
|
[2008/05/21]
Web page published
|
