Description
The APOP protocol allows remote attackers to guess the first 3 characters of a password via man-in-the-middle (MITM) attacks that use crafted message IDs and MD5 collisions. NOTE: this design-level issue potentially affects all products that use APOP, including (1) Thunderbird 1.x before 1.5.0.12 and 2.x before 2.0.0.4, (2) Evolution, (3) mutt, (4) fetchmail before 6.3.8, (5) SeaMonkey 1.0.x before 1.0.9 and 1.1.x before 1.1.2, (6) Balsa 2.3.16 and earlier, (7) Mailfilter before 0.8.2, and possibly other products.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | balsa | 2.3.17-1 | — |
| Debian 14 | claws-mail | 2.9.1-1 | — |
| Debian 14 | fetchmail | 6.3.8-1 | — |
| Debian 14 | mailfilter | 0.8.2-1 | — |
| Debian 14 | mutt | 1.5.18-6 | — |
| Debian 13 | balsa | 2.3.17-1 | — |
| Debian 13 | claws-mail | 2.9.1-1 | — |
| Debian 13 | fetchmail | 6.3.8-1 | — |
| Debian 13 | mailfilter | 0.8.2-1 | — |
| Debian 13 | mutt | 1.5.18-6 | — |
| Debian 12 | balsa | 2.3.17-1 | — |
| Debian 12 | claws-mail | 2.9.1-1 | — |
| Debian 12 | fetchmail | 6.3.8-1 | — |
| Debian 12 | mailfilter | 0.8.2-1 | — |
| Debian 12 | mutt | 1.5.18-6 | — |
| Debian 5.0 | iceape | 1.0.10~pre070720-0etch1+lenny1 | DTSA-47-1 |
| Debian 5.0 | icedove | 1.5.0.12.dfsg1-0etch1+lenny1 | DTSA-46-1 |
| Debian 4.0 | iceape | 1.0.9-0etch1 | DSA-1300-1 |
| Debian 4.0 | icedove | 1.5.0.12.dfsg1-0etch1 | DSA-1305-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | evolution-data-server +1 | 1.8.0-15.0.3.el5 | RHSA-2007:0344 |
| RHEL 5 | fetchmail | 6.3.6-1.0.1.el5 | RHSA-2007:0385 |
| RHEL 5 | mutt | 5:1.4.2.2-3.0.2.el5 | RHSA-2007:0386 |
| RHEL 5 | ruby +8 | 1.8.5-5.el5_3.7 | RHSA-2009:1140 |
| RHEL 5 | thunderbird | 1.5.0.12-1.el5 | RHSA-2007:0401 |
| RHEL 4 | devhelp +1 | 0.10-0.8.el4 | RHSA-2007:0402 |
| RHEL 4 | evolution +1 | 2.0.2-35.0.2.el4 | RHSA-2007:0353 |
| RHEL 4 | fetchmail | 6.2.5-6.0.1.el4 | RHSA-2007:0385 |
| RHEL 4 | irb +6 | 1.8.1-7.el4_8.3 | RHSA-2009:1140 |
| RHEL 4 | mutt | 5:1.4.1-12.0.3.el4 | RHSA-2007:0386 |
| RHEL 4 | seamonkey +5 | 1.0.9-2.el4 | RHSA-2007:0402 |
| RHEL 4 | thunderbird | 1.5.0.12-0.1.el4 | RHSA-2007:0401 |
| RHEL 3 | evolution +1 | 1.4.5-20.el3 | RHSA-2007:0353 |
| RHEL 3 | fetchmail | 6.2.0-3.el3.4 | RHSA-2007:0385 |
| RHEL 3 | mutt | 5:1.4.1-5.el3 | RHSA-2007:0386 |
| RHEL 3 | seamonkey +9 | 1.0.9-0.1.el3 | RHSA-2007:0402 |
| RHEL 2 | fetchmail +1 | 5.9.0-21.7.3.el2.1.6 | RHSA-2007:0385 |
| RHEL 2 | seamonkey +9 | 1.0.9-0.1.el2 | RHSA-2007:0402 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Rhel Productivity 5 | thunderbird | 1.5.0.12-1.el5 | RHSA-2007:0401 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | claws-mail | 4.0.0-2.5 | openSUSE-SU-2024:10686-1 |
| openSUSE Tumbleweed | fetchmail | 6.4.21-2.1 | openSUSE-SU-2024:10753-1 |
| openSUSE Tumbleweed | mpop | 1.4.14-1.1 | openSUSE-SU-2024:11615-1 |
| openSUSE Tumbleweed | mutt | 2.0.7-2.2 | openSUSE-SU-2024:11069-1 |
Advisories 15
- RHSA-2009:1140 Red Hat Security Advisory: ruby security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2007:0344 Red Hat Security Advisory: evolution-data-server security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2007:0402 Red Hat Security Advisory: seamonkey security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2007:0401 Red Hat Security Advisory: thunderbird security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2007:0386 Red Hat Security Advisory: mutt security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2007:0385 Red Hat Security Advisory: fetchmail security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2007:0353 Red Hat Security Advisory: evolution security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-1300-1 iceape Debian Security (DSA / DLA) · Mar 9, 2026
- DTSA-47-1 iceape - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1305-1 icedove - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- DTSA-46-1 icedove - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:10686-1 claws-mail-4.0.0-2.5 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:11069-1 mutt-2.0.7-2.2 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:11615-1 mpop-1.4.14-1.1 on GA media SUSE / openSUSE Security Updates · May 7, 2025
- openSUSE-SU-2024:10753-1 fetchmail-6.4.21-2.1 on GA media SUSE / openSUSE Security Updates · May 7, 2025
References
- 25496 third-party-advisory
- 25529 third-party-advisory
- http://sourceforge.net/forum/forum.php?forum_id=683706
- http://docs.info.apple.com/article.html?artnum=305530
- http://www.claws-mail.org/news.php
- MDKSA-2007:107 vendor-advisory
- 2007-0024 vendor-advisory
- 20070403 Re: APOP vulnerability mailing-list
- 25894 third-party-advisory
- 20070615 rPSA-2007-0122-1 evolution-data-server mailing-list
- ADV-2007-1939 vdb-entry
- 26083 third-party-advisory
- ADV-2007-1468 vdb-entry
- RHSA-2009:1140 vendor-advisory
- HPSBUX02156 vendor-advisory
- 20070531 FLEA-2007-0023-1: firefox mailing-list
- 26415 third-party-advisory
- http://fetchmail.berlios.de/fetchmail-SA-2007-01.txt
- [oss-security] 20090818 Re: CVE-2007-1558 update (was: mailfilter 0.8.2 fixes CVE-2007-1558 (APOP)) mailing-list
- APPLE-SA-2007-05-24 vendor-advisory
- SUSE-SR:2007:014 vendor-advisory
- 25402 third-party-advisory
- HPSBUX02153 vendor-advisory
- 20070402 APOP vulnerability mailing-list
- SUSE-SA:2007:036 vendor-advisory
- GLSA-200706-06 vendor-advisory
- http://sylpheed.sraoss.jp/en/news.html
- 25534 third-party-advisory
- ADV-2007-1994 vdb-entry
- SSA:2007-152-02 vendor-advisory
- 23257 vdb-entry
- USN-469-1 vendor-advisory
- MDKSA-2007:131 vendor-advisory
- DSA-1305 vendor-advisory
- https://issues.rpath.com/browse/RPL-1231
- ADV-2007-1467 vdb-entry
- http://www.mozilla.org/security/announce/2007/mfsa2007-15.html
- ADV-2007-2788 vdb-entry
- https://issues.rpath.com/browse/RPL-1424
- 25664 third-party-advisory
- MDKSA-2007:119 vendor-advisory
- 25546 third-party-advisory
- RHSA-2007:0353 vendor-advisory
- RHSA-2007:0385 vendor-advisory
- 25858 third-party-advisory
- 25798 third-party-advisory
- 25353 third-party-advisory
- ADV-2008-0082 vdb-entry
- [oss-security] 20090815 mailfilter 0.8.2 fixes CVE-2007-1558 (APOP) mailing-list
- RHSA-2007:0401 vendor-advisory
- 2007-0019 vendor-advisory
- 25476 third-party-advisory
- 35699 third-party-advisory
- MDKSA-2007:113 vendor-advisory
- [balsa-list] 20070704 balsa-2.3.17 released mailing-list
- MDKSA-2007:105 vendor-advisory
- RHSA-2007:0386 vendor-advisory
- https://issues.rpath.com/browse/RPL-1232
- 25750 third-party-advisory
- 20070619 FLEA-2007-0026-1: evolution-data-server mailing-list