KMail is a well-known email client software that is part of the KDE Window Manager. It suffers from a serious security vulnerability that allows anyone with read access to the configuration file to decrypt the encrypted password in a very simple manner.
All the accounting information of KDE's KMail is stored in the file .kde/share/config/kmailrc where an entry named passwd can be found. This entry points to the encrypted POP3 password. Everything will be perfect if it were not completely trivial to recover it because of the lack of a good encryption algorithm. In fact, they use the following one:
Obviously, this is vulnerability is quite serious, despite the fact that KMail does not store POP3 passwords by default, and the user has to check the "Store password in configuration file" option for that to happen. Looking at the scrambling algorithm, it is recommended not to use this option.
There is also another problem in KMail that is somehow related with this: when deleting a user account, all the information of this user, including the poorly encrypted password, stays in the configuration file. This makes the menace of this vulnerability even bigger.
