--===============0524258488532916560==
Content-Type: multipart/alternative; boundary=089e0149ced62aea4304fc21ceb9

--089e0149ced62aea4304fc21ceb9
Content-Type: text/plain; charset=ISO-8859-1

KDE Project Security Advisory
=============================

Title:          KMail/KIO POP3 SSL MITM Flaw
Risk Rating:    Medium
CVE:            CVE-2014-3494
Platforms:      All
Versions:       kdelibs 4.10.95 to 4.13.2
Author:         Richard J. Moore <rich@kde.org>
Date:           17 June 2014

Overview
========

The POP3 kioslave used by kmail will accept invalid certificates without
presenting a dialog to the user due a bug that leads to an inability to
display the dialog combined with an error in the way the result is checked.

Impact
======

This flaw allows an active attacker to perform MITM attacks against the
ioslave which could result in the leakage of sensitive data such as the
authentication details and the contents of emails.

Workaround
==========

None

Solution
========

Upgrade to version 4.13.3 or apply the patch at
http://quickgit.kde.org/?p=kdelibs.git&a=commitdiff&h=bbae87dc1be3ae063796a582774bd5642cacdd5d&hp=1ccdb43ed3b32a7798eec6d39bb3c83a6e40228f

Credits
=======

Thanks to Jim Scadden for reporting this issue and writing the initial fix,
and to David Faure for reviewing and improving the fix.

--089e0149ced62aea4304fc21ceb9
Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div class=3D"im" style=3D"font-family:arial,sans-serif;fo=
nt-size:13px">KDE Project Security Advisory<br>=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D<br><br>Title: =
=A0 =A0 =A0 =A0 =A0KMail/KIO POP3 SSL MITM Flaw<br>Risk Rating: =A0 =A0Medi=
um<br>
CVE: =A0 =A0 =A0 =A0 =A0 =A0CVE-2014-3494<br>Platforms: =A0 =A0 =A0All<br><=
/div><span style=3D"font-family:arial,sans-serif;font-size:13px">Versions: =
=A0 =A0 =A0 kdelibs 4.10.95 to 4.13.2</span><br style=3D"font-family:arial,=
sans-serif;font-size:13px">
<div class=3D"im" style=3D"font-family:arial,sans-serif;font-size:13px">Aut=
hor: =A0 =A0 =A0 =A0 Richard J. Moore &lt;<a href=3D"mailto:rich@kde.org">r=
ich@kde.org</a>&gt;<br>Date: =A0 =A0 =A0 =A0 =A0 17 June 2014<br><br>Overvi=
ew<br>=3D=3D=3D=3D=3D=3D=3D=3D<br><br>
The POP3 kioslave used by kmail will accept invalid certificates without<br=
>presenting a dialog to the user due a bug that leads to an inability to<br=
>display the dialog combined with an error in the way the result is checked=
.<br>
<br>Impact<br>=3D=3D=3D=3D=3D=3D<br><br>This flaw allows an active attacker=
 to perform MITM attacks against the<br>ioslave which could result in the l=
eakage of sensitive data such as the<br>authentication details and the cont=
ents of emails.<br>
<br>Workaround<br>=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D<br><br>None<br><br>Solutio=
n<br>=3D=3D=3D=3D=3D=3D=3D=3D<br><br></div><span style=3D"font-family:arial=
,sans-serif;font-size:13px">Upgrade to version 4.13.3 or apply the patch at=
</span><br style=3D"font-family:arial,sans-serif;font-size:13px">
<a href=3D"http://quickgit.kde.org/?p=3Dkdelibs.git&amp;a=3Dcommitdiff&amp;=
h=3Dbbae87dc1be3ae063796a582774bd5642cacdd5d&amp;hp=3D1ccdb43ed3b32a7798eec=
6d39bb3c83a6e40228f" target=3D"_blank" style=3D"font-family:arial,sans-seri=
f;font-size:13px">http://quickgit.kde.org/?p=3Dkdelibs.git&amp;a=3Dcommitdi=
ff&amp;h=3Dbbae87dc1be3ae063796a582774bd5642cacdd5d&amp;hp=3D1ccdb43ed3b32a=
7798eec6d39bb3c83a6e40228f</a><br style=3D"font-family:arial,sans-serif;fon=
t-size:13px">
<div class=3D"im" style=3D"font-family:arial,sans-serif;font-size:13px"><br=
>Credits<br>=3D=3D=3D=3D=3D=3D=3D<br><br>Thanks to Jim Scadden for reportin=
g this issue and writing the initial fix,<br></div><span style=3D"font-fami=
ly:arial,sans-serif;font-size:13px">and to David Faure for reviewing and im=
proving the fix.</span><br>
</div>

--089e0149ced62aea4304fc21ceb9--

--===============0524258488532916560==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
kde-announce mailing list
kde-announce@kde.org
https://mail.kde.org/mailman/listinfo/kde-announce

--===============0524258488532916560==--