PT-2014-9150 · Kde+1 · Plasma-Applet-Nm+1

Published 2014-12-31 · Updated 2014-12-31

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions plasma-applet-nm (affected versions not specified)

Description The issue concerns a lack of server certificate verification in plasma-nm when using OpenVPN, allowing anyone with the preshared key to perform a man-in-the-middle (MITM) attack by impersonating the server. This is due to plasma-nm not instructing OpenVPN to perform server certificate verification.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

MGASA-2014-0560

Affected Products

Openvpn

Plasma-Applet-Nm

References · 6

• https://advisories.mageia.org/MGASA-2014-0560.html · Security Note
• https://osv.dev/vulnerability/MGASA-2014-0560 · Vendor Advisory
• https://lists.fedoraproject.org/pipermail/package-announce/2014-December/146024.html · Vendor Advisory
• http://lwn.net/Vulnerabilities/626419 · Note
• https://bugs.kde.org/show_bug.cgi?id=341069 · Note
• https://bugs.mageia.org/show_bug.cgi?id=14812 · Note