Debian DLA-1825-1：kdepim 安全更新
medium Nessus 插件 ID 126010
语言：
简介
远程 Debian 主机缺少安全更新。描述
提供 KMail 电子邮件客户端 的 kdepim 中发现基于回复的解密 oracle。拥有 S/MIME 或 PGP 加密电子邮件的攻击者可能会将其作为子部件封装到特制的多部件电子邮件中。加密部件可以使用 HTML/CSS 或 ASCII 换行符字符进一步隐藏。攻击者可以将此修改过的多部件电子邮件重新发送给预定的收件人。收件人如果回复了这封（看上去安全）的电子邮件，就会在不知情的情况下向攻击者泄露加密消息部件的明文。对于 Debian 8“Jessie”，这一问题已在 4:4.14.1-1+deb8u2 版本中修复。建议您升级 kdepim 程序包。注意：Tenable Network Security 已直接从 DLA 安全公告中提取上述描述块。Tenable 已尝试在不引入其他问题的情况下，尽可能进行自动整理和排版。解决方案
升级受影响的程序包。另见
https://lists.debian.org/debian-lts-announce/2019/06/msg00012.html
插件详情
严重性: Medium
ID: 126010
文件名: debian_DLA-1825.nasl
版本: 1.5
类型: local
代理: unix
发布时间: 2019/6/19
最近更新时间: 2024/5/15
支持的传感器: Agentless Assessment, Frictionless Assessment Agent, Nessus Agent, Nessus
风险信息
VPR
风险因素: Low
分数: 2.2
CVSS v2
风险因素: Medium
基本分数: 4.3
时间分数: 3.4
矢量: CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N
CVSS 分数来源: CVE-2019-10732
CVSS v3
风险因素: Medium
基本分数: 4.3
时间分数: 3.9
矢量: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
时间矢量: CVSS:3.0/E:P/RL:O/RC:C
漏洞信息
CPE: p-cpe:/a:debian:debian_linux:libkleo4, p-cpe:/a:debian:debian_linux:kdepim-mobileui-data, p-cpe:/a:debian:debian_linux:storageservicemanager, p-cpe:/a:debian:debian_linux:libcomposereditorng4, p-cpe:/a:debian:debian_linux:kdepim, p-cpe:/a:debian:debian_linux:libnoteshared4, p-cpe:/a:debian:debian_linux:knotes, p-cpe:/a:debian:debian_linux:notes-mobile, p-cpe:/a:debian:debian_linux:libksieveui4, p-cpe:/a:debian:debian_linux:libfollowupreminder4, cpe:/o:debian:debian_linux:8.0, p-cpe:/a:debian:debian_linux:kmail-mobile, p-cpe:/a:debian:debian_linux:tasks-mobile, p-cpe:/a:debian:debian_linux:libincidenceeditorsng4, p-cpe:/a:debian:debian_linux:konsolekalendar, p-cpe:/a:debian:debian_linux:kdepim-dbg, p-cpe:/a:debian:debian_linux:libkpgp4, p-cpe:/a:debian:debian_linux:libmailcommon4, p-cpe:/a:debian:debian_linux:korganizer, p-cpe:/a:debian:debian_linux:kjots, p-cpe:/a:debian:debian_linux:knode, p-cpe:/a:debian:debian_linux:kontact, p-cpe:/a:debian:debian_linux:ktimetracker, p-cpe:/a:debian:debian_linux:kdepim-mobile, p-cpe:/a:debian:debian_linux:libeventviews4, p-cpe:/a:debian:debian_linux:libcalendarsupport4, p-cpe:/a:debian:debian_linux:libksieve4, p-cpe:/a:debian:debian_linux:libmessagecomposer4, p-cpe:/a:debian:debian_linux:libpimcommon4, p-cpe:/a:debian:debian_linux:blogilo, p-cpe:/a:debian:debian_linux:libkdepimmobileui4, p-cpe:/a:debian:debian_linux:kaddressbook-mobile, p-cpe:/a:debian:debian_linux:kaddressbook, p-cpe:/a:debian:debian_linux:kalarm, p-cpe:/a:debian:debian_linux:libsendlater4, p-cpe:/a:debian:debian_linux:libmailimporter4, p-cpe:/a:debian:debian_linux:libmessagelist4, p-cpe:/a:debian:debian_linux:kleopatra, p-cpe:/a:debian:debian_linux:libkdgantt2-0, p-cpe:/a:debian:debian_linux:akonadiconsole, p-cpe:/a:debian:debian_linux:kmail, p-cpe:/a:debian:debian_linux:akregator, p-cpe:/a:debian:debian_linux:libkdepimdbusinterfaces4, p-cpe:/a:debian:debian_linux:libmessagecore4, p-cpe:/a:debian:debian_linux:libtemplateparser4, p-cpe:/a:debian:debian_linux:libmessageviewer4, p-cpe:/a:debian:debian_linux:libkmanagesieve4, p-cpe:/a:debian:debian_linux:kdepim-kresources, p-cpe:/a:debian:debian_linux:korganizer-mobile, p-cpe:/a:debian:debian_linux:libkdepim4
必需的 KB 项: Host/local_checks_enabled, Host/Debian/release, Host/Debian/dpkg-l
可利用: true
易利用性: Exploits are available
补丁发布日期: 2019/6/18
漏洞发布日期: 2019/4/7
参考资料信息
CVE: CVE-2019-10732