Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2007-1558 Details

Description

The APOP protocol allows remote attackers to guess the first 3 characters of a password via man-in-the-middle (MITM) attacks that use crafted message IDs and MD5 collisions. NOTE: this design-level issue potentially affects all products that use APOP, including (1) Thunderbird 1.x before 1.5.0.12 and 2.x before 2.0.0.4, (2) Evolution, (3) mutt, (4) fetchmail before 6.3.8, (5) SeaMonkey 1.0.x before 1.0.9 and 1.1.x before 1.1.2, (6) Balsa 2.3.16 and earlier, (7) Mailfilter before 0.8.2, and possibly other products.

Metrics

CVSS 3.x Severity and Vector Strings:

No CVSS 3.x data is available for this CVE.

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
ftp://patches.sgi.com/support/free/security/advisories/20070602-01-P.asc	CVE
http://balsa.gnome.org/download.html	CVE
http://docs.info.apple.com/article.html?artnum=305530	CVE
http://fetchmail.berlios.de/fetchmail-SA-2007-01.txt	CVE
http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00771742	CVE
http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00774579	CVE
http://lists.apple.com/archives/security-announce/2007/May/msg00004.html	CVE
http://mail.gnome.org/archives/balsa-list/2007-July/msg00000.html	CVE
http://secunia.com/advisories/25353	CVE
http://secunia.com/advisories/25402	CVE	Vendor Advisory
http://secunia.com/advisories/25476	CVE
http://secunia.com/advisories/25496	CVE	Vendor Advisory
http://secunia.com/advisories/25529	CVE	Vendor Advisory
http://secunia.com/advisories/25534	CVE
http://secunia.com/advisories/25546	CVE	Vendor Advisory
http://secunia.com/advisories/25559	CVE
http://secunia.com/advisories/25664	CVE
http://secunia.com/advisories/25750	CVE
http://secunia.com/advisories/25798	CVE
http://secunia.com/advisories/25858	CVE
http://secunia.com/advisories/25894	CVE
http://secunia.com/advisories/26083	CVE
http://secunia.com/advisories/26415	CVE
http://secunia.com/advisories/35699	CVE
http://security.gentoo.org/glsa/glsa-200706-06.xml	CVE
https://issues.rpath.com/browse/RPL-1231	CVE
https://issues.rpath.com/browse/RPL-1232	CVE
https://issues.rpath.com/browse/RPL-1424	CVE
http://slackware.com/security/viewer.php?l=slackware-security&y=2007&m=slackware-security.571857	CVE
http://sourceforge.net/forum/forum.php?forum_id=683706	CVE
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9782	CVE
http://sylpheed.sraoss.jp/en/news.html	CVE
http://www.claws-mail.org/news.php	CVE
http://www.debian.org/security/2007/dsa-1300	CVE
http://www.debian.org/security/2007/dsa-1305	CVE	Patch
http://www.mandriva.com/security/advisories?name=MDKSA-2007:105	CVE
http://www.mandriva.com/security/advisories?name=MDKSA-2007:107	CVE
http://www.mandriva.com/security/advisories?name=MDKSA-2007:113	CVE
http://www.mandriva.com/security/advisories?name=MDKSA-2007:119	CVE
http://www.mandriva.com/security/advisories?name=MDKSA-2007:131	CVE
http://www.mozilla.org/security/announce/2007/mfsa2007-15.html	CVE	PatchVendor Advisory
http://www.novell.com/linux/security/advisories/2007_14_sr.html	CVE
http://www.novell.com/linux/security/advisories/2007_36_mozilla.html	CVE
http://www.openwall.com/lists/oss-security/2009/08/15/1	CVE
http://www.openwall.com/lists/oss-security/2009/08/18/1	CVE
http://www.redhat.com/support/errata/RHSA-2007-0344.html	CVE
http://www.redhat.com/support/errata/RHSA-2007-0353.html	CVE
http://www.redhat.com/support/errata/RHSA-2007-0385.html	CVE
http://www.redhat.com/support/errata/RHSA-2007-0386.html	CVE
http://www.redhat.com/support/errata/RHSA-2007-0401.html	CVE
http://www.redhat.com/support/errata/RHSA-2007-0402.html	CVE
http://www.redhat.com/support/errata/RHSA-2009-1140.html	CVE
http://www.securityfocus.com/archive/1/464477/30/0/threaded	CVE	Vendor Advisory
http://www.securityfocus.com/archive/1/464569/100/0/threaded	CVE
http://www.securityfocus.com/archive/1/470172/100/200/threaded	CVE
http://www.securityfocus.com/archive/1/471455/100/0/threaded	CVE
http://www.securityfocus.com/archive/1/471720/100/0/threaded	CVE
http://www.securityfocus.com/archive/1/471842/100/0/threaded	CVE
http://www.securityfocus.com/bid/23257	CVE	Patch
http://www.securitytracker.com/id?1018008	CVE
http://www.trustix.org/errata/2007/0019/	CVE
http://www.trustix.org/errata/2007/0024/	CVE
http://www.ubuntu.com/usn/usn-469-1	CVE
http://www.ubuntu.com/usn/usn-520-1	CVE
http://www.us-cert.gov/cas/techalerts/TA07-151A.html	CVE	US Government Resource
http://www.vupen.com/english/advisories/2007/1466	CVE
http://www.vupen.com/english/advisories/2007/1467	CVE
http://www.vupen.com/english/advisories/2007/1468	CVE
http://www.vupen.com/english/advisories/2007/1480	CVE
http://www.vupen.com/english/advisories/2007/1939	CVE
http://www.vupen.com/english/advisories/2007/1994	CVE
http://www.vupen.com/english/advisories/2007/2788	CVE
http://www.vupen.com/english/advisories/2008/0082	CVE
ftp://patches.sgi.com/support/free/security/advisories/20070602-01-P.asc	[email protected]
http://balsa.gnome.org/download.html	[email protected]
http://docs.info.apple.com/article.html?artnum=305530	[email protected]
http://fetchmail.berlios.de/fetchmail-SA-2007-01.txt	[email protected]
http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00771742	[email protected]
http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00774579	[email protected]
http://lists.apple.com/archives/security-announce/2007/May/msg00004.html	[email protected]
http://mail.gnome.org/archives/balsa-list/2007-July/msg00000.html	[email protected]
http://secunia.com/advisories/25353	[email protected]
http://secunia.com/advisories/25402	[email protected]	Vendor Advisory
http://secunia.com/advisories/25476	[email protected]
http://secunia.com/advisories/25496	[email protected]	Vendor Advisory
http://secunia.com/advisories/25529	[email protected]	Vendor Advisory
http://secunia.com/advisories/25534	[email protected]
http://secunia.com/advisories/25546	[email protected]	Vendor Advisory
http://secunia.com/advisories/25559	[email protected]
http://secunia.com/advisories/25664	[email protected]
http://secunia.com/advisories/25750	[email protected]
http://secunia.com/advisories/25798	[email protected]
http://secunia.com/advisories/25858	[email protected]
http://secunia.com/advisories/25894	[email protected]
http://secunia.com/advisories/26083	[email protected]
http://secunia.com/advisories/26415	[email protected]
http://secunia.com/advisories/35699	[email protected]
http://security.gentoo.org/glsa/glsa-200706-06.xml	[email protected]
https://issues.rpath.com/browse/RPL-1231	[email protected]
https://issues.rpath.com/browse/RPL-1232	[email protected]
https://issues.rpath.com/browse/RPL-1424	[email protected]
http://slackware.com/security/viewer.php?l=slackware-security&y=2007&m=slackware-security.571857	[email protected]
http://sourceforge.net/forum/forum.php?forum_id=683706	[email protected]
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9782	[email protected]
http://sylpheed.sraoss.jp/en/news.html	[email protected]
http://www.claws-mail.org/news.php	[email protected]
http://www.debian.org/security/2007/dsa-1300	[email protected]
http://www.debian.org/security/2007/dsa-1305	[email protected]	Patch
http://www.mandriva.com/security/advisories?name=MDKSA-2007:105	[email protected]
http://www.mandriva.com/security/advisories?name=MDKSA-2007:107	[email protected]
http://www.mandriva.com/security/advisories?name=MDKSA-2007:113	[email protected]
http://www.mandriva.com/security/advisories?name=MDKSA-2007:119	[email protected]
http://www.mandriva.com/security/advisories?name=MDKSA-2007:131	[email protected]
http://www.mozilla.org/security/announce/2007/mfsa2007-15.html	[email protected]	PatchVendor Advisory
http://www.novell.com/linux/security/advisories/2007_14_sr.html	[email protected]
http://www.novell.com/linux/security/advisories/2007_36_mozilla.html	[email protected]
http://www.openwall.com/lists/oss-security/2009/08/15/1	[email protected]
http://www.openwall.com/lists/oss-security/2009/08/18/1	[email protected]
http://www.redhat.com/support/errata/RHSA-2007-0344.html	[email protected]
http://www.redhat.com/support/errata/RHSA-2007-0353.html	[email protected]
http://www.redhat.com/support/errata/RHSA-2007-0385.html	[email protected]
http://www.redhat.com/support/errata/RHSA-2007-0386.html	[email protected]
http://www.redhat.com/support/errata/RHSA-2007-0401.html	[email protected]
http://www.redhat.com/support/errata/RHSA-2007-0402.html	[email protected]
http://www.redhat.com/support/errata/RHSA-2009-1140.html	[email protected]
http://www.securityfocus.com/archive/1/464477/30/0/threaded	[email protected]	Vendor Advisory
http://www.securityfocus.com/archive/1/464569/100/0/threaded	[email protected]
http://www.securityfocus.com/archive/1/470172/100/200/threaded	[email protected]
http://www.securityfocus.com/archive/1/471455/100/0/threaded	[email protected]
http://www.securityfocus.com/archive/1/471720/100/0/threaded	[email protected]
http://www.securityfocus.com/archive/1/471842/100/0/threaded	[email protected]
http://www.securityfocus.com/bid/23257	[email protected]	Patch
http://www.securitytracker.com/id?1018008	[email protected]
http://www.trustix.org/errata/2007/0019/	[email protected]
http://www.trustix.org/errata/2007/0024/	[email protected]
http://www.ubuntu.com/usn/usn-469-1	[email protected]
http://www.ubuntu.com/usn/usn-520-1	[email protected]
http://www.us-cert.gov/cas/techalerts/TA07-151A.html	[email protected]	US Government Resource
http://www.vupen.com/english/advisories/2007/1466	[email protected]
http://www.vupen.com/english/advisories/2007/1467	[email protected]
http://www.vupen.com/english/advisories/2007/1468	[email protected]
http://www.vupen.com/english/advisories/2007/1480	[email protected]
http://www.vupen.com/english/advisories/2007/1939	[email protected]
http://www.vupen.com/english/advisories/2007/1994	[email protected]
http://www.vupen.com/english/advisories/2007/2788	[email protected]
http://www.vupen.com/english/advisories/2008/0082	[email protected]

see all 146 references

Weakness Enumeration

CWE-ID	CWE Name	Source
NVD-CWE-Other	Weakness Not in a Standard CWE Category	[email protected]

Affected Products

Product	Versions
apop protocol apop protocol	All versions
CPE cpe:2.3:a:apop_protocol:apop_protocol:::::::: Remediation No remediation found in references.

Change History

7 change records found show changes

Date	Action	Recorded By
Jun 16, 2026	CVE Modified	[email protected]
Apr 23, 2026	Status Change	[email protected]
Nov 21, 2024	CVE Modified	CVE
May 14, 2024	CVE Modified	[email protected]
Oct 16, 2018	CVE Modified	[email protected]
Oct 11, 2017	CVE Modified	[email protected]
Apr 18, 2007	Initial Analysis	[email protected]