1420217 - (efail) [efail] Full Plaintext Leak in PGP

Status: RESOLVED DUPLICATE of bug 1419417

(Thunderbird :: Security, defect)

Description

[Sebastian Schinzel]

Attachment: pgp_disclosure_thunderbird-20171123.pdf

User Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/62.0.3202.94 Safari/537.36

Steps to reproduce:

Send a modified PGP message to Thunderbird/Enigmail. For a detailed description, see the PDF attached. We will notify GnuPG as well.


Actual results:

The attacker gets the full plaintext of the PGP message.


Expected results:

The attacker should not get the full plaintext of the PGP message.

Comment 1

[Magnus Melin [:mkmelin] (away until Aug 10)]

Jens Müller reported bug 1419417 which is a a subset of this report. 
I suppose this and that are dupes of one another, but this has the more formal report.

Comment 2

[Sebastian Schinzel]

This here is an extended version with another bug in PGP that should affect all implementations.

Comment 3

[Patrick Brunschwig]

I also got this bug reported as Enigmail bug. Is this something that can/should be fixed in Enigmail, or is that on the level of the HTML engine? If I get it right, it also affects S/MIME.

Comment 4

[Sebastian Schinzel]

Please talk to Jens about the bugs he reported, we just included it in our report as a references. Sorry for the confusion.

Regarding the crypto gadget attack: the attacks depends on the attacker getting a backchannel. Right now, we use HTML for this. Disabling all backchannels would somehow mitigate the attack. From a crypto viewpoint, this would not be a very satisfying mitigation though. The core of the vulnerability is certainly the missing authenticated encryption.

Yes, this is the same attack as against S/MIME (ID 1411592).

Comment 5

[Patrick Brunschwig]

1. It seems to me that the report was cut off at page 9. Section 7 is about "Email Clients" and mentions several tested clients. Section 7.1 is about Thunderbird, but there is no section 7.2, and nothing else -- there is no other mail client described. Is that on purpose?

2. The report mentions 3 emails attached, but I cannot find them. Could you attach the emails to the bug?

Comment 6

[Sebastian Schinzel]

Attachment: 01-dec-pgp-smime-html-reply.eml

Comment 7

[Sebastian Schinzel]

Attachment: 02-dec-pgp-smime-html-form.eml

Comment 8

[Sebastian Schinzel]

Attachment: 03-dec-pgp-smime-html-src.eml

Comment 9

[Sebastian Schinzel]

It is on purpose that we only describe findings for Thunderbird here.

I have uploaded the files.

Comment 10

[Patrick Brunschwig]

Incidentally, bug 1412632 addresses section 7.1.1 of the document embedded for PGP/MIME parts: a warning is displayed that the user may be tricked into leaking encrypted information to the recipient. I might improve the warning to explicitly say that this may even be true if the user doesn't see any of the decrypted text.

Comment 11

[Magnus Melin [:mkmelin] (away until Aug 10)]

Marking this as duplicate of bug 1419417. I think we're all done, there and in the dependent bugs.