KDE KMail User Interface Spoofing Vulnerability
- 0
- Add a Comment
- No Related Post
Critical: Less critical
Impact: Spoofing
Where: From remote
Solution Status: Unpatched
Software: KDE 3.x
Noam Rathaus has discovered a vulnerability in KMail, which can be exploited by malicious people to conduct spoofing attacks.
The vulnerability is caused due to an error where HTML code can overlay part of the user interface. This can e.g. be exploited to trick a user into believing a specially crafted mail is signed and coming from a trusted source.
Successful exploitation requires that the option “Prefer HTML to plain text” is enabled (not default setting).
The vulnerability has been confirmed in KMail 1.7.1 on KDE 3.3.1. KDE 3.3.2 is reportedly also affected. Other versions may also be affected.
Solution: Disable the “Prefer HTML to plain text” setting.”
[Continue reading KDE KMail User Interface Spoofing Vulnerability]