NVD Vulnerability Detail

CVE-2014-3494

Summary	kio/usernotificationhandler.cpp in the POP3 kioslave in kdelibs 4.10.95 before 4.13.3 does not properly generate warning notifications, which allows man-in-the-middle attackers to obtain sensitive information via an invalid certificate.
Publication Date	July 2, 2014, 1:55 a.m.
Registration Date	Jan. 26, 2021, 3:10 p.m.
Last Update	Nov. 21, 2024, 11:08 a.m.

Affected software configurations

Configuration1		or higher	or less	more than	less than
cpe:2.3:o:opensuse:opensuse:13.1:::::::*

Related information, measures and tools

No	URL	タグ
1	http://lists.opensuse.org/opensuse-updates/2015-03/msg00068.html
2	http://lists.opensuse.org/opensuse-updates/2015-03/msg00068.html
3	http://quickgit.kde.org/?p=kdelibs.git&a=commitdiff&h=bbae87dc1be3ae063796a582774bd5642cacdd5d&hp=1ccdb43ed3b32a7798eec6d39bb3c83a6e40228f	Exploit Patch
4	http://quickgit.kde.org/?p=kdelibs.git&a=commitdiff&h=bbae87dc1be3ae063796a582774bd5642cacdd5d&hp=1ccdb43ed3b32a7798eec6d39bb3c83a6e40228f	Exploit Patch
5	http://www.kde.org/info/security/advisory-20140618-1.txt	Vendor Advisory
6	http://www.kde.org/info/security/advisory-20140618-1.txt	Vendor Advisory
7	http://www.securityfocus.com/bid/68113
8	http://www.securityfocus.com/bid/68113

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-200	情報漏えい	https://cwe.mitre.org/data/definitions/200.html

JVN Vulnerability Information

kdelibs の POP3 kioslave の kio/usernotificationhandler.cpp における重要な情報を取得される脆弱性

Title	kdelibs の POP3 kioslave の kio/usernotificationhandler.cpp における重要な情報を取得される脆弱性
Summary	kdelibs の POP3 kioslave の kio/usernotificationhandler.cpp は、警告通知を適切に生成しないため、重要な情報を取得される脆弱性が存在します。
Possible impacts	中間者攻撃 (man-in-the-middle attack) により、無効な証明書を介して、重要な情報を取得される可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	June 17, 2014, midnight
Registration Date	July 3, 2014, 4:25 p.m.
Last Update	July 3, 2014, 4:25 p.m.

Affected System

KDE project

kdelibs 4.10.95 以上 4.13.3 未満

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2014-3494	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3494
National Vulnerability Database (NVD)
2	CVE-2014-3494	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-3494

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-200	https://jvndb.jvn.jp/ja/cwe/CWE-200.html

ベンダー情報

No	Name	URL
KDE QuickGit
1	Don't require a job to handle messageboxes.	http://quickgit.kde.org/?p=kdelibs.git&a=commitdiff&h=bbae87dc1be3ae063796a582774bd5642cacdd5d&hp=1ccdb43ed3b32a7798eec6d39bb3c83a6e40228f
KDE Security Advisory
2	KMail/KIO POP3 SSL MITM Flaw	http://www.kde.org/info/security/advisory-20140618-1.txt

Change Log

No	Changed Details	Date of change
0	[2014年07月03日] 掲載	Feb. 17, 2018, 10:37 a.m.