[CVE-2014-3494] KMail/KIO POP3 SSL MITM Flaw
Bug #1332064 reported by
Rohan Garg
This bug affects 1 person
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
kde4libs (Ubuntu) |
Fix Released
|
Undecided
|
Unassigned | ||
Saucy |
Fix Released
|
Undecided
|
Unassigned | ||
Trusty |
Fix Released
|
Undecided
|
Unassigned | ||
Utopic |
Fix Released
|
Undecided
|
Unassigned |
Bug Description
Overview
========
The POP3 kioslave used by kmail will accept invalid certificates without
presenting a dialog to the user due a bug that leads to an inability to
display the dialog combined with an error in the way the result is checked.
Impact
======
This flaw allows an active attacker to perform MITM attacks against the
ioslave which could result in the leakage of sensitive data such as the
authentication details and the contents of emails.
Workaround
==========
None
Solution
========
Upgrade to version 4.13.3 or apply the patch at
http://
CVE References
To post a comment you must log in.
Debdiff for trusty