Executive Summary

Summary
Title KDE-Libs vulnerability
Informations
Name USN-1248-1 First vendor Publication 2011-10-25
Vendor Ubuntu Last vendor Modification 2011-10-25
Severity (Vendor) N/A Revision N/A

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score NA
Base Score NA Environmental Score NA
impact SubScore NA Temporal Score NA
Exploitabality Sub Score NA
 
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:M/Au:N/C:N/I:P/A:N)
Cvss Base Score 4.3 Attack Range Network
Cvss Impact Score 2.9 Attack Complexity Medium
Cvss Expoit Score 8.6 Authentication None Required
Calculate full CVSS 2.0 Vectors scores

Detail

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 11.04 - Ubuntu 10.10 - Ubuntu 10.04 LTS

Summary:

KDE-Libs could improperly display fraudulent security certificates.

Software Description: - kde4libs: KDE 4 core applications and libraries

Details:

Tim Brown discovered that KSSL in KDE-Libs did not properly perform input validation when displaying the common name (CN) for an SSL certificate. An attacker could exploit this to spoof the common name which could be used in an attack to trick the user into accepting a fraudulent certificate. This issue only affected Ubuntu 10.04 LTS and Ubuntu 10.10. (CVE-2011-3365)

It was discovered that KIO in KDE-Libs did not properly perform input validation during proxy authentication. An attacker could exploit this to modify displaying of the realm and proxy URL.

Update instructions:

The problem can be corrected by updating your system to the following package versions:

Ubuntu 11.04:
libkio5 4:4.6.5-0ubuntu1.1

Ubuntu 10.10:
libkio5 4:4.5.5-0ubuntu2.1

Ubuntu 10.04 LTS:
kdelibs5 4:4.4.5-0ubuntu1.2

After a standard system update you need to restart any applications that use KSSL and KIO, such as Konqueror and Rekong, to make all the necessary changes.

References:
http://www.ubuntu.com/usn/usn-1248-1
CVE-2011-3365

Package Information:
https://launchpad.net/ubuntu/+source/kde4libs/4:4.6.5-0ubuntu1.1
https://launchpad.net/ubuntu/+source/kde4libs/4:4.5.5-0ubuntu2.1
https://launchpad.net/ubuntu/+source/kde4libs/4:4.4.5-0ubuntu1.2

Original Source

Url : http://www.ubuntu.com/usn/USN-1248-1

CWE : Common Weakness Enumeration

% Id Name
100 % CWE-20 Improper Input Validation

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:17794
 
Oval ID: oval:org.mitre.oval:def:17794
Title: USN-1248-1 -- kde4libs vulnerability
Description: KDE-Libs could improperly display fraudulent security certificates.
Family: unix Class: patch
Reference(s): USN-1248-1
CVE-2011-3365
 Version: 5
Platform(s): Ubuntu 11.04
Ubuntu 10.10
Ubuntu 10.04
 Product(s): kde4libs
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:21776
 
Oval ID: oval:org.mitre.oval:def:21776
Title: RHSA-2011:1385: kdelibs and kdelibs3 security update (Moderate)
Description: The KDE SSL Wrapper (KSSL) API in KDE SC 4.6.0 through 4.7.1, and possibly earlier versions, does not use a certain font when rendering certificate fields in a security dialog, which allows remote attackers to spoof the common name (CN) of a certificate via rich text.
Family: unix Class: patch
Reference(s): RHSA-2011:1385-01
CESA-2011:1385
CVE-2011-3365
 Version: 4
Platform(s): Red Hat Enterprise Linux 5
Red Hat Enterprise Linux 6
CentOS Linux 5
CentOS Linux 6
 Product(s): kdelibs
kdelibs3
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:23311
 
Oval ID: oval:org.mitre.oval:def:23311
Title: DEPRECATED: ELSA-2011:1385: kdelibs and kdelibs3 security update (Moderate)
Description: The KDE SSL Wrapper (KSSL) API in KDE SC 4.6.0 through 4.7.1, and possibly earlier versions, does not use a certain font when rendering certificate fields in a security dialog, which allows remote attackers to spoof the common name (CN) of a certificate via rich text.
Family: unix Class: patch
Reference(s): ELSA-2011:1385-01
CVE-2011-3365
 Version: 7
Platform(s): Oracle Linux 5
Oracle Linux 6
 Product(s): kdelibs
kdelibs3
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:23626
 
Oval ID: oval:org.mitre.oval:def:23626
Title: ELSA-2011:1385: kdelibs and kdelibs3 security update (Moderate)
Description: The KDE SSL Wrapper (KSSL) API in KDE SC 4.6.0 through 4.7.1, and possibly earlier versions, does not use a certain font when rendering certificate fields in a security dialog, which allows remote attackers to spoof the common name (CN) of a certificate via rich text.
Family: unix Class: patch
Reference(s): ELSA-2011:1385-01
CVE-2011-3365
 Version: 6
Platform(s): Oracle Linux 5
Oracle Linux 6
 Product(s): kdelibs
kdelibs3
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:27107
 
Oval ID: oval:org.mitre.oval:def:27107
Title: RHSA-2011:1364 -- kdelibs security and enhancement update (Moderate)
Description: The kdelibs packages provide libraries for the K Desktop Environment (KDE). An input sanitization flaw was found in the KSSL (KDE SSL Wrapper) API. An attacker could supply a specially-crafted SSL certificate (for example, via a web page) to an application using KSSL, such as the Konqueror web browser, causing misleading information to be presented to the user, possibly tricking them into accepting the certificate as valid. (CVE-2011-3365) This update also adds the following enhancement: * kdelibs provided its own set of trusted Certificate Authority (CA) certificates. This update makes kdelibs use the system set from the ca-certificates package, instead of its own copy. (BZ#743951) Users should upgrade to these updated packages, which contain backported patches to correct this issue and add this enhancement. The desktop must be restarted (log out, then log back in) for this update to take effect.
Family: unix Class: patch
Reference(s): RHSA-2011:1364
CVE-2011-3365
 Version: 3
Platform(s): Red Hat Enterprise Linux 6
 Product(s): kdelibs
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:27947
 
Oval ID: oval:org.mitre.oval:def:27947
Title: ELSA-2011-1364 -- kdelibs security and enhancement update (moderate)
Description: [6:4.3.4-11.4] - Resolves: bz#743951, use ca-certificates' ca-bundle.crt [6:4.3.4-11.3] - Resolves: bz#743515, CVE-2011-3365 - input validation failure
Family: unix Class: patch
Reference(s): ELSA-2011-1364
CVE-2011-3365
 Version: 3
Platform(s): Oracle Linux 6
 Product(s): kdelibs
Definition Synopsis:

CPE : Common Platform Enumeration

TypeDescriptionCount
Application 8

OpenVAS Exploits

Date Description
2012-07-30 Name : CentOS Update for kdelibs CESA-2011:1385 centos4 x86_64
File : nvt/gb_CESA-2011_1385_kdelibs_centos4_x86_64.nasl
2012-07-30 Name : CentOS Update for kdelibs CESA-2011:1385 centos5 x86_64
File : nvt/gb_CESA-2011_1385_kdelibs_centos5_x86_64.nasl
2012-07-09 Name : RedHat Update for kdelibs RHSA-2011:1364-01
File : nvt/gb_RHSA-2011_1364-01_kdelibs.nasl
2012-04-02 Name : Fedora Update for kgamma FEDORA-2011-13417
File : nvt/gb_fedora_2011_13417_kgamma_fc16.nasl
2012-04-02 Name : Fedora Update for ksaneplugin FEDORA-2011-13417
File : nvt/gb_fedora_2011_13417_ksaneplugin_fc16.nasl
2012-04-02 Name : Fedora Update for kruler FEDORA-2011-13417
File : nvt/gb_fedora_2011_13417_kruler_fc16.nasl
2012-04-02 Name : Fedora Update for konsole FEDORA-2011-13417
File : nvt/gb_fedora_2011_13417_konsole_fc16.nasl
2012-04-02 Name : Fedora Update for kmplot FEDORA-2011-13417
File : nvt/gb_fedora_2011_13417_kmplot_fc16.nasl
2012-04-02 Name : Fedora Update for klettres FEDORA-2011-13417
File : nvt/gb_fedora_2011_13417_klettres_fc16.nasl
2012-04-02 Name : Fedora Update for kiten FEDORA-2011-13417
File : nvt/gb_fedora_2011_13417_kiten_fc16.nasl
2012-04-02 Name : Fedora Update for khangman FEDORA-2011-13417
File : nvt/gb_fedora_2011_13417_khangman_fc16.nasl
2012-04-02 Name : Fedora Update for kgeography FEDORA-2011-13417
File : nvt/gb_fedora_2011_13417_kgeography_fc16.nasl
2012-04-02 Name : Fedora Update for kwordquiz FEDORA-2011-13417
File : nvt/gb_fedora_2011_13417_kwordquiz_fc16.nasl
2012-04-02 Name : Fedora Update for kdesdk FEDORA-2011-13417
File : nvt/gb_fedora_2011_13417_kdesdk_fc16.nasl
2012-04-02 Name : Fedora Update for kdeplasma-addons FEDORA-2011-13417
File : nvt/gb_fedora_2011_13417_kdeplasma-addons_fc16.nasl
2012-04-02 Name : Fedora Update for kdepim-runtime FEDORA-2011-13417
File : nvt/gb_fedora_2011_13417_kdepim-runtime_fc16.nasl
2012-04-02 Name : Fedora Update for kdenetwork FEDORA-2011-13417
File : nvt/gb_fedora_2011_13417_kdenetwork_fc16.nasl
2012-04-02 Name : Fedora Update for kdemultimedia FEDORA-2011-13417
File : nvt/gb_fedora_2011_13417_kdemultimedia_fc16.nasl
2012-04-02 Name : Fedora Update for ksnapshot FEDORA-2011-13417
File : nvt/gb_fedora_2011_13417_ksnapshot_fc16.nasl
2012-04-02 Name : Fedora Update for kturtle FEDORA-2011-13417
File : nvt/gb_fedora_2011_13417_kturtle_fc16.nasl
2012-04-02 Name : Fedora Update for kdepim FEDORA-2011-13417
File : nvt/gb_fedora_2011_13417_kdepim_fc16.nasl
2012-04-02 Name : Fedora Update for libkdcraw FEDORA-2011-13417
File : nvt/gb_fedora_2011_13417_libkdcraw_fc16.nasl
2012-04-02 Name : Fedora Update for libkdeedu FEDORA-2011-13417
File : nvt/gb_fedora_2011_13417_libkdeedu_fc16.nasl
2012-04-02 Name : Fedora Update for libkexiv2 FEDORA-2011-13417
File : nvt/gb_fedora_2011_13417_libkexiv2_fc16.nasl
2012-04-02 Name : Fedora Update for libkipi FEDORA-2011-13417
File : nvt/gb_fedora_2011_13417_libkipi_fc16.nasl
2012-04-02 Name : Fedora Update for libksane FEDORA-2011-13417
File : nvt/gb_fedora_2011_13417_libksane_fc16.nasl
2012-04-02 Name : Fedora Update for okular FEDORA-2011-13417
File : nvt/gb_fedora_2011_13417_okular_fc16.nasl
2012-04-02 Name : Fedora Update for oxygen-icon-theme FEDORA-2011-13417
File : nvt/gb_fedora_2011_13417_oxygen-icon-theme_fc16.nasl
2012-04-02 Name : Fedora Update for rocs FEDORA-2011-13417
File : nvt/gb_fedora_2011_13417_rocs_fc16.nasl
2012-04-02 Name : Fedora Update for shared-desktop-ontologies FEDORA-2011-13417
File : nvt/gb_fedora_2011_13417_shared-desktop-ontologies_fc16.nasl
2012-04-02 Name : Fedora Update for smokegen FEDORA-2011-13417
File : nvt/gb_fedora_2011_13417_smokegen_fc16.nasl
2012-04-02 Name : Fedora Update for smokekde FEDORA-2011-13417
File : nvt/gb_fedora_2011_13417_smokekde_fc16.nasl
2012-04-02 Name : Fedora Update for smokeqt FEDORA-2011-13417
File : nvt/gb_fedora_2011_13417_smokeqt_fc16.nasl
2012-04-02 Name : Fedora Update for kdebase-workspace FEDORA-2011-13417
File : nvt/gb_fedora_2011_13417_kdebase-workspace_fc16.nasl
2012-04-02 Name : Fedora Update for kcolorchooser FEDORA-2011-13417
File : nvt/gb_fedora_2011_13417_kcolorchooser_fc16.nasl
2012-04-02 Name : Fedora Update for kbruch FEDORA-2011-13417
File : nvt/gb_fedora_2011_13417_kbruch_fc16.nasl
2012-04-02 Name : Fedora Update for kde-settings FEDORA-2011-13417
File : nvt/gb_fedora_2011_13417_kde-settings_fc16.nasl
2012-04-02 Name : Fedora Update for kate FEDORA-2011-13417
File : nvt/gb_fedora_2011_13417_kate_fc16.nasl
2012-04-02 Name : Fedora Update for kdeaccessibility FEDORA-2011-13417
File : nvt/gb_fedora_2011_13417_kdeaccessibility_fc16.nasl
2012-04-02 Name : Fedora Update for kalzium FEDORA-2011-13417
File : nvt/gb_fedora_2011_13417_kalzium_fc16.nasl
2012-04-02 Name : Fedora Update for kdeadmin FEDORA-2011-13417
File : nvt/gb_fedora_2011_13417_kdeadmin_fc16.nasl
2012-04-02 Name : Fedora Update for kdeartwork FEDORA-2011-13417
File : nvt/gb_fedora_2011_13417_kdeartwork_fc16.nasl
2012-04-02 Name : Fedora Update for kdebase-runtime FEDORA-2011-13417
File : nvt/gb_fedora_2011_13417_kdebase-runtime_fc16.nasl
2012-04-02 Name : Fedora Update for kalgebra FEDORA-2011-13417
File : nvt/gb_fedora_2011_13417_kalgebra_fc16.nasl
2012-04-02 Name : Fedora Update for gwenview FEDORA-2011-13417
File : nvt/gb_fedora_2011_13417_gwenview_fc16.nasl
2012-04-02 Name : Fedora Update for kdeedu FEDORA-2011-13417
File : nvt/gb_fedora_2011_13417_kdeedu_fc16.nasl
2012-04-02 Name : Fedora Update for cantor FEDORA-2011-13417
File : nvt/gb_fedora_2011_13417_cantor_fc16.nasl
2012-04-02 Name : Fedora Update for akonadi FEDORA-2011-13417
File : nvt/gb_fedora_2011_13417_akonadi_fc16.nasl
2012-04-02 Name : Fedora Update for kdegames FEDORA-2011-13417
File : nvt/gb_fedora_2011_13417_kdegames_fc16.nasl
2012-04-02 Name : Fedora Update for kdegraphics-strigi-analyzer FEDORA-2011-13417
File : nvt/gb_fedora_2011_13417_kdegraphics-strigi-analyzer_fc16.nasl
2012-04-02 Name : Fedora Update for PyKDE4 FEDORA-2011-13417
File : nvt/gb_fedora_2011_13417_PyKDE4_fc16.nasl
2012-04-02 Name : Fedora Update for step FEDORA-2011-13417
File : nvt/gb_fedora_2011_13417_step_fc16.nasl
2012-04-02 Name : Fedora Update for kdegraphics-thumbnailers FEDORA-2011-13417
File : nvt/gb_fedora_2011_13417_kdegraphics-thumbnailers_fc16.nasl
2012-04-02 Name : Fedora Update for kdegraphics FEDORA-2011-13417
File : nvt/gb_fedora_2011_13417_kdegraphics_fc16.nasl
2012-03-29 Name : Fedora Update for kdelibs FEDORA-2012-3483
File : nvt/gb_fedora_2012_3483_kdelibs_fc15.nasl
2012-03-19 Name : Fedora Update for marble FEDORA-2011-13417
File : nvt/gb_fedora_2011_13417_marble_fc16.nasl
2012-03-19 Name : Fedora Update for kdelibs FEDORA-2011-13417
File : nvt/gb_fedora_2011_13417_kdelibs_fc16.nasl
2012-03-19 Name : Fedora Update for svgpart FEDORA-2011-13417
File : nvt/gb_fedora_2011_13417_svgpart_fc16.nasl
2012-03-19 Name : Fedora Update for kdepimlibs FEDORA-2011-13417
File : nvt/gb_fedora_2011_13417_kdepimlibs_fc16.nasl
2012-03-19 Name : Fedora Update for kdetoys FEDORA-2011-13417
File : nvt/gb_fedora_2011_13417_kdetoys_fc16.nasl
2012-03-19 Name : Fedora Update for parley FEDORA-2011-13417
File : nvt/gb_fedora_2011_13417_parley_fc16.nasl
2012-03-19 Name : Fedora Update for blinken FEDORA-2011-13417
File : nvt/gb_fedora_2011_13417_blinken_fc16.nasl
2012-03-19 Name : Fedora Update for kdeutils FEDORA-2011-13417
File : nvt/gb_fedora_2011_13417_kdeutils_fc16.nasl
2012-03-19 Name : Fedora Update for kstars FEDORA-2011-13417
File : nvt/gb_fedora_2011_13417_kstars_fc16.nasl
2012-03-19 Name : Fedora Update for kdebase FEDORA-2011-13417
File : nvt/gb_fedora_2011_13417_kdebase_fc16.nasl
2012-03-19 Name : Fedora Update for kig FEDORA-2011-13417
File : nvt/gb_fedora_2011_13417_kig_fc16.nasl
2012-03-19 Name : Fedora Update for kolourpaint FEDORA-2011-13417
File : nvt/gb_fedora_2011_13417_kolourpaint_fc16.nasl
2012-03-19 Name : Fedora Update for kamera FEDORA-2011-13417
File : nvt/gb_fedora_2011_13417_kamera_fc16.nasl
2012-03-19 Name : Fedora Update for kanagram FEDORA-2011-13417
File : nvt/gb_fedora_2011_13417_kanagram_fc16.nasl
2012-03-19 Name : Fedora Update for kross-interpreters FEDORA-2011-13417
File : nvt/gb_fedora_2011_13417_kross-interpreters_fc16.nasl
2012-03-19 Name : Fedora Update for kde-l10n FEDORA-2011-13417
File : nvt/gb_fedora_2011_13417_kde-l10n_fc16.nasl
2012-03-19 Name : Fedora Update for ktouch FEDORA-2011-13417
File : nvt/gb_fedora_2011_13417_ktouch_fc16.nasl
2011-11-11 Name : CentOS Update for kdelibs CESA-2011:1385 centos4 i386
File : nvt/gb_CESA-2011_1385_kdelibs_centos4_i386.nasl
2011-11-03 Name : Mandriva Update for kdelibs4 MDVSA-2011:162 (kdelibs4)
File : nvt/gb_mandriva_MDVSA_2011_162.nasl
2011-10-31 Name : Ubuntu Update for kde4libs USN-1248-1
File : nvt/gb_ubuntu_USN_1248_1.nasl
2011-10-21 Name : RedHat Update for kdelibs and kdelibs3 RHSA-2011:1385-01
File : nvt/gb_RHSA-2011_1385-01_kdelibs_and_kdelibs3.nasl
2011-10-21 Name : CentOS Update for kdelibs CESA-2011:1385 centos5 i386
File : nvt/gb_CESA-2011_1385_kdelibs_centos5_i386.nasl
0000-00-00 Name : FreeBSD Ports: kdelibs
File : nvt/freebsd_kdelibs5.nasl

Open Source Vulnerability Database (OSVDB)

Id Description
76016 KDE KSSL Certificate Text Format CN Field RTF Data Parsing Certificate Spoofi...

Nessus® Vulnerability Scanner

Date Description
2014-12-15 Name : The remote Gentoo host is missing one or more security-related patches.
File : gentoo_GLSA-201412-09.nasl - Type : ACT_GATHER_INFO
2014-06-30 Name : The remote Gentoo host is missing one or more security-related patches.
File : gentoo_GLSA-201406-34.nasl - Type : ACT_GATHER_INFO
2014-06-13 Name : The remote openSUSE host is missing a security update.
File : suse_11_4_kdelibs4-111010.nasl - Type : ACT_GATHER_INFO
2013-07-12 Name : The remote Oracle Linux host is missing one or more security updates.
File : oraclelinux_ELSA-2011-1364.nasl - Type : ACT_GATHER_INFO
2013-07-12 Name : The remote Oracle Linux host is missing one or more security updates.
File : oraclelinux_ELSA-2011-1385.nasl - Type : ACT_GATHER_INFO
2012-08-01 Name : The remote Scientific Linux host is missing one or more security updates.
File : sl_20111011_kdelibs_on_SL6_x.nasl - Type : ACT_GATHER_INFO
2012-08-01 Name : The remote Scientific Linux host is missing one or more security updates.
File : sl_20111019_kdelibs_and_kdelibs3_on_SL4_x.nasl - Type : ACT_GATHER_INFO
2011-11-02 Name : The remote Mandriva Linux host is missing one or more security updates.
File : mandriva_MDVSA-2011-162.nasl - Type : ACT_GATHER_INFO
2011-10-26 Name : The remote Ubuntu host is missing one or more security-related patches.
File : ubuntu_USN-1248-1.nasl - Type : ACT_GATHER_INFO
2011-10-24 Name : The remote FreeBSD host is missing one or more security-related updates.
File : freebsd_pkg_6d21a287fce011e0a82800235a5f2c9a.nasl - Type : ACT_GATHER_INFO
2011-10-20 Name : The remote CentOS host is missing one or more security updates.
File : centos_RHSA-2011-1385.nasl - Type : ACT_GATHER_INFO
2011-10-20 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2011-1385.nasl - Type : ACT_GATHER_INFO
2011-10-12 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2011-1364.nasl - Type : ACT_GATHER_INFO
2011-10-05 Name : The remote Fedora host is missing one or more security updates.
File : fedora_2011-13417.nasl - Type : ACT_GATHER_INFO

Alert History

If you want to see full details history, please login or register.
0
Date Informations
2014-02-17 11:59:11
  • Multiple Updates