SB2016052301 - Man-in-the-middle attack in GNOME Evolution Data Server
Published: May 23, 2016
Security Bulletin ID
SB2016052301
Severity
Low
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Adjecent network
Highest impact
Information disclosure
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Man-in-the-middle attack (CVE-ID: CVE-2016-10727)
The vulnerability allows an adjacent attacker to conduct man-in-the-middle attack..
The vulnerability exists in the IMAPx component of GNOME Evolution Data Server due to the IMAPx component, as defined in the camel/providers/imapx/camel-imapx-server.c source code file of the affected software, does not support STARTTLS. An adjacent attacker can sniff network traffic between the two systems and gain access to sensitive information, such as the user's password, to conduct further attacks.
Remediation
Install update from vendor's website.