[ GLSA 200412-16 ] kdelibs, kdebase: Multiple vulnerabilities

[GLSA]

Gentoo Linux Security Advisory

Title: kdelibs, kdebase: Multiple vulnerabilities (GLSA 200412-16)
Severity: normal
Exploitable: remote and local
Date: December 19, 2004
Bug(s): #72804, #73869
ID: 200412-16

Synopsis

kdelibs and kdebase contain a flaw allowing password disclosure when creating a link to a remote file. Furthermore Konqueror is vulnerable to window injection.

Background

KDE is a feature-rich graphical desktop environment for Linux and Unix-like Operating Systems. The KDE core libraries (kdebase and kdelibs) provide native support for many protocols. Konqueror is the KDE web browser and filemanager.

Affected Packages

Package: kde-base/kdelibs
Vulnerable: < 3.3.2-r1
Unaffected: >= 3.2.3-r4 < 3.2.4
Unaffected: >= 3.3.1-r2 < 3.3.2
Unaffected: >= 3.3.2-r1
Architectures: All supported architectures

Package: kde-base/kdebase
Vulnerable: < 3.3.2-r1
Unaffected: >= 3.2.3-r3 < 3.2.4
Unaffected: >= 3.3.1-r2 < 3.3.2
Architectures: All supported architectures


Description

Daniel Fabian discovered that the KDE core libraries contain a flaw allowing password disclosure by making a link to a remote file. When creating this link, the resulting URL contains authentication credentials used to access the remote file (CAN 2004-1171). The Konqueror webbrowser allows websites to load webpages into a window or tab currently used by another website (CAN-2004-1158).

Impact

A malicious user could have access to the authentication credentials of other users depending on the file permissions. A malicious website could use the window injection vulnerability to load content in a window apparently belonging to another website.

Workaround

There is no known workaround at this time.

Resolution

All kdelibs users should upgrade to the latest version: