kio/usernotificationhandler.cpp in the POP3 kioslave in kdelibs 4.10.95 before 4.13.3 does not properly generate warning notifications, which allows man-in-the-middle attackers to obtain sensitive information via an invalid certificate.

KDE and QT were updated to fix security issues and bugs.

The following vulerabilities were fixed :

  - CVE-2014-0190: Malformed GIF files could have crashed QT     based applications

  - CVE-2015-0295: Malformed BMP files could have crashed QT     based applications

  - CVE-2014-8600: Multiple cross-site scripting (XSS)     vulnerabilities in the KDE runtime could have allowed     remote attackers to insert arbitrary web script or HTML     via crafted URIs using one of several supported URL     schemes

  - CVE-2014-8483: A missing size check in the Blowfish ECB     could have lead to a crash of Konversation or 11 byte     information leak

  - CVE-2014-3494: The KMail POP3 kioslave accepted invalid     certifiates and allowed a man-in-the-middle (MITM)     attack

Additionally, Konversation was updated to 1.5.1 to fix bugs.

Richard J. Moore reports :

The POP3 kioslave used by KMail will accept invalid certificates without presenting a dialog to the user due a bug that leads to an inability to display the dialog combined with an error in the way the result is checked.

This flaw allows an active attacker to perform MITM attacks against the ioslave which could result in the leakage of sensitive data such as the authentication details and the contents of emails.

Fix security issue where POP3 kioslave silently accepted invalid SSL certificates.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201406-34 (KDE Libraries: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in KDE Libraries. Please       review the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could cause a man-in-the-middle attack via any       certificate issued by a legitimate certification authority. Furthermore,       a local attacker may gain knowledge of user passwords through an       information leak.
  Workaround :

    There is no known workaround at this time.

ID	Name	Product	Family	Severity
82014	openSUSE Security Update : kdebase4-runtime / kdelibs4 / konversation / etc (openSUSE-2015-251)	Nessus	SuSE Local Security Checks	medium
76543	FreeBSD : kdelibs4 -- KMail/KIO POP3 SSL Man-in-the-middle Flaw (4a114331-0d24-11e4-8dd2-5453ed2e2b49)	Nessus	FreeBSD Local Security Checks	medium
76374	Fedora 19 : kdelibs-4.11.5-4.fc19 (2014-7572)	Nessus	Fedora Local Security Checks	medium
76334	Fedora 20 : kdelibs-4.12.5-4.fc20 (2014-7579)	Nessus	Fedora Local Security Checks	medium
76305	GLSA-201406-34 : KDE Libraries: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	medium

Detections

Analytics

CVE-2014-3494

medium

Tenable Plugins

medium

medium

medium

medium

medium