Bug#335731: security issue in enigmail package (CAN-2005-3256)

[Alexander Sack]

Package: enigmail
Version: 2:0.91-4
Severity: critical
Tags: security patch

If there is a key on your keyring, that has an empty UID (no name,
e-mail address, etc.), mail may be encrypted to that UID, although the
recipient was not choosen by the user. This may lead to  disclosure of
confidential data to others.

This is CAN-2005-3256.

Patch received from upstream is attached.

 - asac

--- /cygdrive/f/Enigmail/source/enigmail/src/ui/content/enigmailUserSelection.js	2005-06-01 17:08:40.578115200 +0200
+++ ./enigmailUserSelection.js	2005-09-08 07:18:44.896859200 +0200
@@ -154,6 +154,8 @@
      return r;
    }
 
+   var emptyUid = " -"; // replace with localizable string
+   
    window.arguments[RESULT].cancelled=true;
 
    var secretOnly = (window.arguments[INPUT].options.indexOf("private")>= 0);
@@ -249,6 +251,9 @@
          aUserList.push(userObj);
          break;
        case "uid":
+         if (listRow[USER_ID].length == 0) {
+            listRow[USER_ID] = emptyUid;
+         }
          if (typeof(userObj.userId) != "string") {
            userObj.userId=EnigConvertGpgToUnicode(listRow[USER_ID].replace(/\\e3A/g, ":"));
          }
@@ -337,7 +342,7 @@
             escapedMailAddr=mailAddr.replace(escapeRegExp, "\\$1");
             s1=new RegExp("[, ]?"+escapedMailAddr+"[, ]","i");
             s2=new RegExp("[, ]"+escapedMailAddr+"[, ]?","i");
-            if (invalidAddr.indexOf(" "+mailAddr+" ")<0) {
+            if ((mailAddr != emptyUid) && (invalidAddr.indexOf(" "+mailAddr+" ")<0)) {
               aValidUsers.push(mailAddr);
               aUserList[i].activeState =(toAddr.search(s1)>=0 || toAddr.search(s2)>=0) ? 1 : 0;
             }
@@ -368,7 +373,7 @@
                     escapedMailAddr=mailAddr.replace(escapeRegExp, "\\$1");
                     s1=new RegExp("[, ]?"+escapedMailAddr+"[, ]","i");
                     s2=new RegExp("[, ]"+escapedMailAddr+"[, ]?","i");
-                    if (toAddr.search(s1)>=0 || toAddr.search(s2)>=0) {
+                    if ((mailAddr != emptyUid) && (toAddr.search(s1)>=0 || toAddr.search(s2)>=0)) {
                       aUserList[i].activeState = 1;
                     }
                   }