Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 513726 (CVE-2014-3494) - <kde-base/kdelibs-{4.12.5-r1,4.13.2-r1}: KMail/KIO POP3 SSL MITM Flaw (CVE-2014-3494)
Summary: <kde-base/kdelibs-{4.12.5-r1,4.13.2-r1}: KMail/KIO POP3 SSL MITM Flaw (CVE-20...
Status: RESOLVED FIXED
Alias: CVE-2014-3494
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal minor (vote)
Assignee: Gentoo Security
URL: http://seclists.org/oss-sec/2014/q2/577
Whiteboard: B4 [glsa]
Keywords:
Depends on:
Blocks:
 
Reported: 2014-06-18 20:23 UTC by Kristian Fiskerstrand (RETIRED)
Modified: 2014-06-29 20:50 UTC (History)
0 users

See Also:
Package list:
Runtime testing required: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Kristian Fiskerstrand (RETIRED) gentoo-dev 2014-06-18 20:23:14 UTC
From ${URL}: 

Overview
========

The POP3 kioslave used by kmail will accept invalid certificates without
presenting a dialog to the user due a bug that leads to an inability to
display the dialog combined with an error in the way the result is checked.

Impact
======

This flaw allows an active attacker to perform MITM attacks against the
ioslave which could result in the leakage of sensitive data such as the
authentication details and the contents of emails.

Workaround
==========

None

Solution
========

Upgrade to version 4.13.3 or apply the patch at
http://quickgit.kde.org/?p=kdelibs.git&a=commitdiff&h=bbae87dc1be3ae063796a582774bd5642cacdd5d&hp=1ccdb43ed3b32a7798eec6d39bb3c83a6e40228f

Credits
=======

Thanks to Jim Scadden for reporting this issue and writing the initial fix,
and to David Faure for reviewing and improving the fix.
Comment 1 Chris Reffett (RETIRED) gentoo-dev Security 2014-06-18 20:53:35 UTC
@kde team: I figure we might as well wait for 4.13.3 and then just stabilize the lot of that, in place. Unless other KDE team members object, of course.
Comment 2 Maciej Mrozowski gentoo-dev 2014-06-18 22:18:46 UTC
I bumped 4.12.5-r1 (current stable) and 4.13.2-r1 (likely next stable candidate) with the fix.
Comment 3 Agostino Sarubbo gentoo-dev 2014-06-19 08:12:26 UTC
(In reply to Maciej Mrozowski from comment #2)
> I bumped 4.12.5-r1 (current stable) and 4.13.2-r1 (likely next stable
> candidate) with the fix.

I don't see anything in tree.
Comment 4 Frank Krömmelbein 2014-06-19 09:20:26 UTC
@Agostino Sarubbo

*kdelibs-4.12.5-r1 (18 Jun 2014)
*kdelibs-4.13.2-r1 (18 Jun 2014)
18 Jun 2014; Maciej Mrozowski (reavertm) 
+files/kdelibs-4.13.2-CVE-2014-3494.patch, +kdelibs-4.12.5-r1.ebuild,
+kdelibs-4.13.2-r1.ebuild, -kdelibs-4.13.2.ebuild:
Bug 513726, CVE-2014-3494
Comment 5 Agostino Sarubbo gentoo-dev 2014-06-19 09:28:00 UTC
(In reply to Frank Krömmelbein from comment #4)
> @Agostino Sarubbo
> 
> *kdelibs-4.12.5-r1 (18 Jun 2014)
> *kdelibs-4.13.2-r1 (18 Jun 2014)
> 18 Jun 2014; Maciej Mrozowski (reavertm) 
> +files/kdelibs-4.13.2-CVE-2014-3494.patch, +kdelibs-4.12.5-r1.ebuild,
> +kdelibs-4.13.2-r1.ebuild, -kdelibs-4.13.2.ebuild:
> Bug 513726, CVE-2014-3494

the bug was filed against the wrong package.


@kde: is fine to stabilize 4.12.5-r1 ?
Comment 6 Michael Palimaka (kensington) gentoo-dev 2014-06-19 12:06:22 UTC
Arch teams, please test and stabilise kde-base/kdelibs-4.12.5-r1

Target KEYWORDS="amd64 ppc ppc64 x86".

Thanks!
Comment 7 Chris Reffett (RETIRED) gentoo-dev Security 2014-06-19 12:07:34 UTC
MitM which only discloses information is B4. Will remove 4.13.{0,1} from tree shortly.
Comment 8 Agostino Sarubbo gentoo-dev 2014-06-19 13:09:04 UTC
(In reply to Chris Reffett from comment #7)
> MitM which only discloses information is B4. Will remove 4.13.{0,1} from
> tree shortly.

Quoting the advisory:
> could result in the leakage of sensitive data such as the 
> authentication details and the contents of emails.

Apart the consideration of what the MITM is, I interpret "authentication details" as username/password which is 3 as per https://www.gentoo.org/security/en/vulnerability-policy.xml#doc_chap3.
Comment 9 Mikle Kolyada (RETIRED) archtester Gentoo Infrastructure gentoo-dev Security 2014-06-22 21:54:22 UTC
amd64 stable
Comment 10 Mikle Kolyada (RETIRED) archtester Gentoo Infrastructure gentoo-dev Security 2014-06-22 21:55:16 UTC
x86 stable
Comment 11 Mikle Kolyada (RETIRED) archtester Gentoo Infrastructure gentoo-dev Security 2014-06-29 16:51:18 UTC
ppc/ppc64 stable

Added to existng glsa draft. 
Cleanup, please!
Comment 12 Andreas K. Hüttel archtester gentoo-dev 2014-06-29 18:28:17 UTC
All vulnerable versions removed. Thanks everyone.
Comment 13 GLSAMaker/CVETool Bot gentoo-dev 2014-06-29 20:50:05 UTC
This issue was resolved and addressed in
 GLSA 201406-34 at http://security.gentoo.org/glsa/glsa-201406-34.xml
by GLSA coordinator Mikle Kolyada (Zlogene).