Detections
Analytics

FreeBSD : mail/trojita -- may leak mail contents (not user credentials) over unencrypted connection (36f9ac43-b2ac-11e3-8752-080027ef73ec)

medium Nessus Plugin ID 73150

Language:

Synopsis

The remote FreeBSD host is missing a security-related update.

Description

Jan Kundrat reports :

An SSL stripping vulnerability was discovered in Trojita, a fast Qt IMAP e-mail client. User's credentials are never leaked, but if a user tries to send an e-mail, the automatic saving into the 'sent' or 'draft' folders could happen over a plaintext connection even if the user's preferences specify STARTTLS as a requirement.

Solution

Update the affected package.

See Also

http://www.nessus.org/u?8d61b6c0

http://www.nessus.org/u?5805cae4

Plugin Details

Severity: Medium

ID: 73150

File Name: freebsd_pkg_36f9ac43b2ac11e38752080027ef73ec.nasl

Version: 1.7

Type: local

Published: 3/24/2014

Updated: 1/6/2021

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Low

Score: 3.4

CVSS v2

Risk Factor: Medium

Base Score: 4.3

Vector: CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N

Vulnerability Information

CPE: p-cpe:/a:freebsd:freebsd:trojita, cpe:/o:freebsd:freebsd

Required KB Items: Host/local_checks_enabled, Host/FreeBSD/release, Host/FreeBSD/pkg_info

Patch Publication Date: 3/23/2014

Vulnerability Publication Date: 3/20/2014

Reference Information

CVE: CVE-2014-2567