kdelibs and kdebase contain a flaw allowing password disclosure when
creating a link to a remote file. Furthermore Konqueror is vulnerable
to window injection.
Background
==========
KDE is a feature-rich graphical desktop environment for Linux and
Unix-like Operating Systems. The KDE core libraries (kdebase and
kdelibs) provide native support for many protocols. Konqueror is the
KDE web browser and filemanager.
Affected packages
=================
-------------------------------------------------------------------
Package / Vulnerable / Unaffected
-------------------------------------------------------------------
1 kde-base/kdelibs < 3.3.2-r1 *>= 3.2.3-r4
*>= 3.3.1-r2
>= 3.3.2-r1
2 kde-base/kdebase < 3.3.2-r1 *>= 3.2.3-r3
*>= 3.3.1-r2
-------------------------------------------------------------------
2 affected packages on all of their supported architectures.
-------------------------------------------------------------------
Description
===========
Daniel Fabian discovered that the KDE core libraries contain a flaw
allowing password disclosure by making a link to a remote file. When
creating this link, the resulting URL contains authentication
credentials used to access the remote file (CAN 2004-1171).
The Konqueror webbrowser allows websites to load webpages into a window
or tab currently used by another website (CAN-2004-1158).
Impact
======
A malicious user could have access to the authentication credentials of
other users depending on the file permissions.
A malicious website could use the window injection vulnerability to
load content in a window apparently belonging to another website.
Workaround
==========
There is no known workaround at this time.
Resolution
==========
All kdelibs users should upgrade to the latest version:
Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users machines is of utmost
importance to us. Any security concerns should be addressed to
security (at) gentoo (dot) org [email concealed] or alternatively, you may file a bug at
http://bugs.gentoo.org.
License
=======
Copyright 2004 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).
The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.
Gentoo Linux Security Advisory GLSA 200412-16
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
http://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Severity: Normal
Title: kdelibs, kdebase: Multiple vulnerabilities
Date: December 19, 2004
Bugs: #72804, #73869
ID: 200412-16
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Synopsis
========
kdelibs and kdebase contain a flaw allowing password disclosure when
creating a link to a remote file. Furthermore Konqueror is vulnerable
to window injection.
Background
==========
KDE is a feature-rich graphical desktop environment for Linux and
Unix-like Operating Systems. The KDE core libraries (kdebase and
kdelibs) provide native support for many protocols. Konqueror is the
KDE web browser and filemanager.
Affected packages
=================
-------------------------------------------------------------------
Package / Vulnerable / Unaffected
-------------------------------------------------------------------
1 kde-base/kdelibs < 3.3.2-r1 *>= 3.2.3-r4
*>= 3.3.1-r2
>= 3.3.2-r1
2 kde-base/kdebase < 3.3.2-r1 *>= 3.2.3-r3
*>= 3.3.1-r2
-------------------------------------------------------------------
2 affected packages on all of their supported architectures.
-------------------------------------------------------------------
Description
===========
Daniel Fabian discovered that the KDE core libraries contain a flaw
allowing password disclosure by making a link to a remote file. When
creating this link, the resulting URL contains authentication
credentials used to access the remote file (CAN 2004-1171).
The Konqueror webbrowser allows websites to load webpages into a window
or tab currently used by another website (CAN-2004-1158).
Impact
======
A malicious user could have access to the authentication credentials of
other users depending on the file permissions.
A malicious website could use the window injection vulnerability to
load content in a window apparently belonging to another website.
Workaround
==========
There is no known workaround at this time.
Resolution
==========
All kdelibs users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=kde-base/kdelibs-3.2.3-r4"
All kdebase users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=kde-base/kdebase-3.2.3-r3"
References
==========
[ 1 ] KDE Security Advisory: plain text password exposure
http://www.kde.org/info/security/advisory-20041209-1.txt
[ 2 ] CAN 2004-1171
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-1171
[ 3 ] KDE Security Advisory: Konqueror Window Injection Vulnerability
http://www.kde.org/info/security/advisory-20041213-1.txt
[ 4 ] CAN 2004-1158
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-1158
Availability
============
This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:
http://security.gentoo.org/glsa/glsa-200412-16.xml
Concerns?
=========
Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users machines is of utmost
importance to us. Any security concerns should be addressed to
security (at) gentoo (dot) org [email concealed] or alternatively, you may file a bug at
http://bugs.gentoo.org.
License
=======
Copyright 2004 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).
The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.
http://creativecommons.org/licenses/by-sa/2.0
[ reply ]