CVE-2017-17688 Information disclosure in n/a
Attackers can exfiltrate plaintext from encrypted emails by exploiting malleability in OpenPGP implementations that mishandle Modification Detection Codes.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2017-17688?
CVE-2017-17688 is a medium-severity vulnerability in Microsoft Outlook, published on 16 May 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The OpenPGP specification allows a Cipher Feedback Mode (CFB) malleability-gadget attack that can indirectly lead to plaintext exfiltration, aka EFAIL. NOTE: third parties report that this is a problem in applications that mishandle the Modification Detection Code (MDC) feature or accept an obsolete packet type, not a problem in the OpenPGP specification
Which versions are affected by CVE-2017-17688?
It affects 11 products.
Products include Apple Mail, Bloop Airmail, Emclient Emclient, Flipdogsolutions Maildroid, Freron Mailmate, Horde Horde Imp and 5 more.
How do I fix CVE-2017-17688?
Apply the vendor's patch.
Is CVE-2017-17688 being exploited?
There is no known exploitation of CVE-2017-17688 in the wild and no public exploit code.
Other vulnerabilities in Microsoft Outlook
Sources
Also known as DEBIAN-CVE-2017-17688, GHSA-87q6-mg5f-mp98.