ispdbservice.cpp in KDE Kmail before 6.2.0 allows man-in-the-middle attackers to trigger use of an attacker-controlled mail server because cleartext HTTP is used for a URL such as http://autoconfig.example.com or http://example.com/.well-known/autoconfig for retrieving the configuration. This is related to kmail-account-wizard.

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-7729-1 advisory.

    Damian Poddebniak, Christian Dresen, Jens Mller, Fabian Ising, Sebastian Schinzel, Simon Friedberger,     Juraj Somorovsky, and Jrg Schwenk discovered that the KMail application of KDE PIM could be made to leak     the plaintext of S/MIME encrypted emails when retrieving external content in emails. Under certain     configurations, if a user were tricked into opening a specially crafted email, an attacker could possibly     use this issue to obtain the plaintext of an encrypted email. This update mitigates the issue by     preventing KMail from automatically loading external content. (CVE-2017-17689)

    Jens Mller, Marcus Brinkmann, Damian Poddebniak, Sebastian Schinzel, and Jrg Schwenk discovered that     the KMail application of KDE PIM could be made to leak the plaintext of S/MIME or PGP encrypted emails. If     a user were tricked into replying to a specially crafted email, an attacker could possibly use this issue     to obtain the plaintext of an encrypted email. (CVE-2019-10732)

    It was discovered that the KMail application of KDE PIM could be made to attach files to an email without     the user's knowledge. If a user were tricked into sending an email created by a specially crafted mailto     link, an attacker could possibly use this issue to obtain sensitive files. This update mitigates the issue     by displaying a warning to the user when files are attached in this way. (CVE-2020-11880)

    It was discovered that the Account Wizard application of KDE PIM used HTTP rather than HTTPS when     retrieving certain email server configurations. An attacker could possibly use this issue to cause email     clients to use an attacker-controlled email server. This issue only affected Ubuntu 16.04 LTS.
    (CVE-2024-50624)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-7732-1 advisory.

    It was discovered that KMail Account Wizard used HTTP rather than HTTPS when retrieving certain email     server configurations. An attacker could possibly use this issue to cause email clients to use an     attacker-controlled email server.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has a package installed that is affected by a vulnerability as referenced in the dla-4196 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-4196-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                    Thorsten Alteholz     May 30, 2025                                  https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : kmail-account-wizard     Version        : 4:20.08.3-1+deb11u1     CVE ID         : CVE-2024-50624


    An issue has been found in kmail-account-wizard, a wizard for KDE PIM     applications account setup.
    The issues is about a man-in-the-middle-attack when using autoconf for     retrieving configuration.
    Please also note that for configuration with autoconf.example.com, the     config is first fetched with https and the former http is used only as     fallback. For configuration via example.com/.well-known/autoconfig the     config is now fetched only with https.



    For Debian 11 bullseye, this problem has been fixed in version     4:20.08.3-1+deb11u1.

    We recommend that you upgrade your kmail-account-wizard packages.

    For the detailed security status of kmail-account-wizard please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/kmail-account-wizard

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2024:0353-1 advisory.

    - CVE-2024-50624: Fixed that plaintext HTTP was used for URLs when retrieving configuration files     (boo#1232454, kde#487882)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
261427	Ubuntu 14.04 LTS / 16.04 LTS : KDE PIM vulnerabilities (USN-7729-1)	Nessus	Ubuntu Local Security Checks	medium
261425	Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS : KMail Account Wizard vulnerability (USN-7732-1)	Nessus	Ubuntu Local Security Checks	medium
237619	Debian dla-4196 : accountwizard - security update	Nessus	Debian Local Security Checks	medium
210464	openSUSE 15 Security Update : kmail-account-wizard (openSUSE-SU-2024:0353-1)	Nessus	SuSE Local Security Checks	medium

Detections

Analytics

CVE-2024-50624

medium

Tenable Plugins

medium

medium

medium

medium