FreeBSD : mail/trojita -- may leak mail contents (not user credentials) over unencrypted connection (36f9ac43-b2ac-11e3-8752-080027ef73ec)

Medium Nessus Plugin ID 73150


The remote FreeBSD host is missing a security-related update.


Jan Kundrat reports :

An SSL stripping vulnerability was discovered in Trojita, a fast Qt IMAP e-mail client. User's credentials are never leaked, but if a user tries to send an e-mail, the automatic saving into the 'sent' or 'draft' folders could happen over a plaintext connection even if the user's preferences specify STARTTLS as a requirement.


Update the affected package.

See Also

Plugin Details

Severity: Medium

ID: 73150

File Name: freebsd_pkg_36f9ac43b2ac11e38752080027ef73ec.nasl

Version: $Revision: 1.3 $

Type: local

Published: 2014/03/24

Modified: 2016/05/26

Dependencies: 12634

Risk Information

Risk Factor: Medium


Base Score: 4.3

Vector: CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N

Vulnerability Information

CPE: p-cpe:/a:freebsd:freebsd:trojita, cpe:/o:freebsd:freebsd

Required KB Items: Host/local_checks_enabled, Host/FreeBSD/release, Host/FreeBSD/pkg_info

Patch Publication Date: 2014/03/23

Vulnerability Publication Date: 2014/03/20

Reference Information

CVE: CVE-2014-2567