FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

kdelibs4 -- KMail/KIO POP3 SSL Man-in-the-middle Flaw

Affected packages
4.10.95 <= kdelibs < 4.12.5_2

Details

VuXML ID 4a114331-0d24-11e4-8dd2-5453ed2e2b49
Discovery 2014-06-17
Entry 2014-07-16

Richard J. Moore reports:

The POP3 kioslave used by KMail will accept invalid certificates without presenting a dialog to the user due a bug that leads to an inability to display the dialog combined with an error in the way the result is checked.

This flaw allows an active attacker to perform MITM attacks against the ioslave which could result in the leakage of sensitive data such as the authentication details and the contents of emails.

References

Bugtraq ID 68113
CVE Name CVE-2014-3494
Message http://lists.kde.org/?l=kde-announce&m=140312275318160&w=2