Executive Summary
| Summary | |
|---|---|
| Title | Updated kdebase and kdelibs packages fix location bar spoofing issues |
| Informations | |||
|---|---|---|---|
| Name | MDKSA-2007:176 | First vendor Publication | 2007-09-06 |
| Vendor | Mandriva | Last vendor Modification | 2007-09-06 |
| Severity (Vendor) | N/A | Revision | N/A |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:N/AC:M/Au:N/C:P/I:P/A:P) | |||
|---|---|---|---|
| Cvss Base Score | 6.8 | Attack Range | Network |
| Cvss Impact Score | 6.4 | Attack Complexity | Medium |
| Cvss Expoit Score | 8.6 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| konqueror/konq_combo.cc in Konqueror 3.5.7 allows remote attackers to spoof the data: URI scheme in the address bar via a long URI with trailing whitespace, which prevents the beginning of the URI from being displayed. (CVE-2007-3820) KDE Konqueror 3.5.7 allows remote attackers to spoof the URL address bar by calling setInterval with a small interval and changing the window.location property. (CVE-2007-4224) Visual truncation vulnerability in KDE Konqueror 3.5.7 allows remote attackers to spoof the URL address bar via an http URI with a large amount of whitespace in the user/password portion. (CVE-2007-4225) Updated packages fix these issues. |
Original Source
| Url : http://www.mandriva.com/security/advisories?name=MDKSA-2007:176 |
CWE : Common Weakness Enumeration
| % | Id | Name |
|---|---|---|
| 100 % | CWE-59 | Improper Link Resolution Before File Access ('Link Following') |
OVAL Definitions
| Definition Id: oval:org.mitre.oval:def:10345 | |||
| Oval ID: | oval:org.mitre.oval:def:10345 | ||
| Title: | konqueror/konq_combo.cc in Konqueror 3.5.7 allows remote attackers to spoof the data: URI scheme in the address bar via a long URI with trailing whitespace, which prevents the beginning of the URI from being displayed. | ||
| Description: | konqueror/konq_combo.cc in Konqueror 3.5.7 allows remote attackers to spoof the data: URI scheme in the address bar via a long URI with trailing whitespace, which prevents the beginning of the URI from being displayed. | ||
| Family: | unix | Class: | vulnerability |
| Reference(s): | CVE-2007-3820 | Version: | 5 |
| Platform(s): | Red Hat Enterprise Linux 4 CentOS Linux 4 Oracle Linux 4 Red Hat Enterprise Linux 5 CentOS Linux 5 Oracle Linux 5 | Product(s): | |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:17655 | |||
| Oval ID: | oval:org.mitre.oval:def:17655 | ||
| Title: | USN-502-1 -- kdebase, kdelibs vulnerabilities | ||
| Description: | It was discovered that Konqueror could be tricked into displaying incorrect URLs. | ||
| Family: | unix | Class: | patch |
| Reference(s): | USN-502-1 CVE-2007-3820 CVE-2007-4224 CVE-2007-4225 | Version: | 5 |
| Platform(s): | Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 | Product(s): | kdebase kdelibs |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:22442 | |||
| Oval ID: | oval:org.mitre.oval:def:22442 | ||
| Title: | ELSA-2007:0909: kdelibs security update (Moderate) | ||
| Description: | KDE Konqueror 3.5.7 allows remote attackers to spoof the URL address bar by calling setInterval with a small interval and changing the window.location property. | ||
| Family: | unix | Class: | patch |
| Reference(s): | ELSA-2007:0909-02 CVE-2007-0242 CVE-2007-0537 CVE-2007-1308 CVE-2007-1564 CVE-2007-3820 CVE-2007-4224 | Version: | 29 |
| Platform(s): | Oracle Linux 5 | Product(s): | kdelibs |
| Definition Synopsis: | |||
| Definition Id: oval:org.mitre.oval:def:22556 | |||
| Oval ID: | oval:org.mitre.oval:def:22556 | ||
| Title: | ELSA-2007:0905: kdebase security update (Moderate) | ||
| Description: | backend/session.c in KDM in KDE 3.3.0 through 3.5.7, when autologin is configured and "shutdown with password" is enabled, allows remote attackers to bypass the password requirement and login to arbitrary accounts via unspecified vectors. | ||
| Family: | unix | Class: | patch |
| Reference(s): | ELSA-2007:0905-02 CVE-2007-4569 CVE-2007-3820 CVE-2007-4224 | Version: | 17 |
| Platform(s): | Oracle Linux 5 | Product(s): | kdebase |
| Definition Synopsis: | |||
| Definition Id: oval:org.mitre.oval:def:9879 | |||
| Oval ID: | oval:org.mitre.oval:def:9879 | ||
| Title: | KDE Konqueror 3.5.7 allows remote attackers to spoof the URL address bar by calling setInterval with a small interval and changing the window.location property. | ||
| Description: | KDE Konqueror 3.5.7 allows remote attackers to spoof the URL address bar by calling setInterval with a small interval and changing the window.location property. | ||
| Family: | unix | Class: | vulnerability |
| Reference(s): | CVE-2007-4224 | Version: | 5 |
| Platform(s): | Red Hat Enterprise Linux 4 CentOS Linux 4 Oracle Linux 4 Red Hat Enterprise Linux 5 CentOS Linux 5 Oracle Linux 5 | Product(s): | |
| Definition Synopsis: | |||
| |||
CPE : Common Platform Enumeration
| Type | Description | Count |
|---|---|---|
| Application | 1 |
OpenVAS Exploits
| Date | Description |
|---|---|
| 2009-10-10 | Name : SLES9: Security update for KDE libraries File : nvt/sles9p5018374.nasl |
| 2009-04-09 | Name : Mandriva Update for konqueror MDKSA-2007:176 (konqueror) File : nvt/gb_mandriva_MDKSA_2007_176.nasl |
| 2009-03-23 | Name : Ubuntu Update for kdebase, kdelibs vulnerabilities USN-502-1 File : nvt/gb_ubuntu_USN_502_1.nasl |
| 2009-02-27 | Name : Fedora Update for kdelibs FEDORA-2007-1699 File : nvt/gb_fedora_2007_1699_kdelibs_fc7.nasl |
| 2009-02-27 | Name : Fedora Update for kdebase FEDORA-2007-1700 File : nvt/gb_fedora_2007_1700_kdebase_fc7.nasl |
| 2009-02-27 | Name : Fedora Update for kdebase FEDORA-2007-2361 File : nvt/gb_fedora_2007_2361_kdebase_fc7.nasl |
| 2009-02-27 | Name : Fedora Update for kdebase FEDORA-2007-2985 File : nvt/gb_fedora_2007_2985_kdebase_fc7.nasl |
| 2009-02-27 | Name : Fedora Update for kdelibs FEDORA-2007-2985 File : nvt/gb_fedora_2007_2985_kdelibs_fc7.nasl |
| 2009-02-27 | Name : Fedora Update for kdebase FEDORA-2007-716 File : nvt/gb_fedora_2007_716_kdebase_fc6.nasl |
| 2009-02-27 | Name : Fedora Update for kdelibs FEDORA-2007-716 File : nvt/gb_fedora_2007_716_kdelibs_fc6.nasl |
| 2008-09-04 | Name : FreeBSD Ports: kdebase3 File : nvt/freebsd_kdebase3.nasl |
| 0000-00-00 | Name : Slackware Advisory SSA:2007-264-01 kdebase, kdelibs File : nvt/esoft_slk_ssa_2007_264_01.nasl |
Open Source Vulnerability Database (OSVDB)
| Id | Description |
|---|---|
| 37245 | KDE Konqueror setInterval() window.location Property Address Bar Spoofing |
| 37244 | KDE Konqueror URI Whitespace Saturation Address Bar Spoofing |
| 37242 | KDE Konqueror konqueror/konq_combo.cc data: URI Scheme Address Bar Spoofing |
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2013-07-12 | Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2007-0909.nasl - Type : ACT_GATHER_INFO |
| 2013-07-12 | Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2007-0905.nasl - Type : ACT_GATHER_INFO |
| 2012-08-01 | Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20071008_kdelibs_on_SL5_x.nasl - Type : ACT_GATHER_INFO |
| 2012-08-01 | Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20071008_kdebase_on_SL5_x.nasl - Type : ACT_GATHER_INFO |
| 2007-12-13 | Name : The remote SuSE 10 host is missing a security-related patch. File : suse_fileshareset-4433.nasl - Type : ACT_GATHER_INFO |
| 2007-11-10 | Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-502-1.nasl - Type : ACT_GATHER_INFO |
| 2007-11-06 | Name : The remote Fedora host is missing a security update. File : fedora_2007-2361.nasl - Type : ACT_GATHER_INFO |
| 2007-11-06 | Name : The remote Fedora host is missing a security update. File : fedora_2007-1700.nasl - Type : ACT_GATHER_INFO |
| 2007-11-06 | Name : The remote Fedora host is missing a security update. File : fedora_2007-1699.nasl - Type : ACT_GATHER_INFO |
| 2007-10-17 | Name : The remote openSUSE host is missing a security update. File : suse_fileshareset-4454.nasl - Type : ACT_GATHER_INFO |
| 2007-10-12 | Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2007-0909.nasl - Type : ACT_GATHER_INFO |
| 2007-10-12 | Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2007-0905.nasl - Type : ACT_GATHER_INFO |
| 2007-10-09 | Name : The remote Fedora Core host is missing one or more security updates. File : fedora_2007-716.nasl - Type : ACT_GATHER_INFO |
| 2007-10-09 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2007-0905.nasl - Type : ACT_GATHER_INFO |
| 2007-10-09 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2007-0909.nasl - Type : ACT_GATHER_INFO |
| 2007-09-24 | Name : The remote FreeBSD host is missing one or more security-related updates. File : freebsd_pkg_14ad2a2866d211dcb25f02e0185f8d72.nasl - Type : ACT_GATHER_INFO |
| 2007-09-24 | Name : The remote Slackware host is missing a security update. File : Slackware_SSA_2007-264-01.nasl - Type : ACT_GATHER_INFO |
| 2007-09-07 | Name : The remote Mandrake Linux host is missing one or more security updates. File : mandrake_MDKSA-2007-176.nasl - Type : ACT_GATHER_INFO |
Alert History
| Date | Informations |
|---|---|
| 2014-02-17 11:38:52 |
|
