SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Generic)  >   KDE Vendors:   KDE.org
(Gentoo Issues Fix) KDE May Disclose SMB Passwords to Remote Users Via URLs
SecurityTracker Alert ID:  1012619
SecurityTracker URL:  http://securitytracker.com/id/1012619
CVE Reference:   CVE-2004-1171   (Links to External Site)
Date:  Dec 19 2004
Impact:   Disclosure of authentication information
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): 3.2.x, 3.3.0, 3.3.1, and 3.3.2
Description:   A vulnerability was reported in KDE. Passwords may be disclosed via URLs.

The vendor reported that when a user creates a link to a remote file using various KDE applications, the resulting link may include authentication credentials for the remote system. This may include Samba passwords for files located on SMB servers.

The password for SMB protocol URLs is always addded in plaintext to the URL in the link reference file ('*.desktop' file).

Daniel Fabian is credited with reporting this flaw.

The vendor's original advisory is available at:

http://www.kde.org/info/security/advisory-20041209-1.txt

The original SEC Consult advisory is available at:

http://www.sec-consult.com/index.php?id=118

Impact:   A user may disclose passwords for SMB shares as part of a URL.
Solution:   Gentoo has released a fix and indicates that all kdelibs users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=kde-base/kdelibs-3.2.3-r4"

All kdebase users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=kde-base/kdebase-3.2.3-r3"

Vendor URL:  www.kde.org/info/security/advisory-20041209-1.txt (Links to External Site)
Cause:   Access control error
Underlying OS:  Linux (Gentoo)

Message History:   This archive entry is a follow-up to the message listed below.
Dec 9 2004 KDE May Disclose SMB Passwords to Remote Users Via URLs



 Source Message Contents

Subject:  [gentoo-announce] [ GLSA 200412-16 ] kdelibs, kdebase: Multiple vulnerabilities


--nextPart1438587.vJ6iSbSvzF
Content-Type: text/plain;
  charset="us-ascii"
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory                           GLSA 200412-16
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
                                            http://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

  Severity: Normal
     Title: kdelibs, kdebase: Multiple vulnerabilities
      Date: December 19, 2004
      Bugs: #72804, #73869
        ID: 200412-16

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis
========

kdelibs and kdebase contain a flaw allowing password disclosure when
creating a link to a remote file. Furthermore Konqueror is vulnerable
to window injection.

Background
==========

KDE is a feature-rich graphical desktop environment for Linux and
Unix-like Operating Systems. The KDE core libraries (kdebase and
kdelibs) provide native support for many protocols. Konqueror is the
KDE web browser and filemanager.

Affected packages
=================

    -------------------------------------------------------------------
     Package           /  Vulnerable  /                     Unaffected
    -------------------------------------------------------------------
  1  kde-base/kdelibs     < 3.3.2-r1                      *>= 3.2.3-r4
                                                          *>= 3.3.1-r2
                                                           >= 3.3.2-r1
  2  kde-base/kdebase     < 3.3.2-r1                      *>= 3.2.3-r3
                                                          *>= 3.3.1-r2
    -------------------------------------------------------------------
     2 affected packages on all of their supported architectures.
    -------------------------------------------------------------------

Description
===========

Daniel Fabian discovered that the KDE core libraries contain a flaw
allowing password disclosure by making a link to a remote file. When
creating this link, the resulting URL contains authentication
credentials used to access the remote file (CAN 2004-1171).

The Konqueror webbrowser allows websites to load webpages into a window
or tab currently used by another website (CAN-2004-1158).

Impact
======

A malicious user could have access to the authentication credentials of
other users depending on the file permissions.

A malicious website could use the window injection vulnerability to
load content in a window apparently belonging to another website.

Workaround
==========

There is no known workaround at this time.

Resolution
==========

All kdelibs users should upgrade to the latest version:

    # emerge --sync
    # emerge --ask --oneshot --verbose ">=kde-base/kdelibs-3.2.3-r4"

All kdebase users should upgrade to the latest version:

    # emerge --sync
    # emerge --ask --oneshot --verbose ">=kde-base/kdebase-3.2.3-r3"

References
==========

  [ 1 ] KDE Security Advisory: plain text password exposure
        http://www.kde.org/info/security/advisory-20041209-1.txt
  [ 2 ] CAN 2004-1171
        http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-1171
  [ 3 ] KDE Security Advisory: Konqueror Window Injection Vulnerability
        http://www.kde.org/info/security/advisory-20041213-1.txt
  [ 4 ] CAN 2004-1158
        http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-1158

Availability
============

This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:

  http://security.gentoo.org/glsa/glsa-200412-16.xml

Concerns?
=========

Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users machines is of utmost
importance to us. Any security concerns should be addressed to
security@gentoo.org or alternatively, you may file a bug at
http://bugs.gentoo.org.

License
=======

Copyright 2004 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).

The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.

http://creativecommons.org/licenses/by-sa/2.0

--nextPart1438587.vJ6iSbSvzF
Content-Type: application/pgp-signature

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.6 (GNU/Linux)

iD8DBQBBxZI8zKC5hMHO6rkRAvFpAJ9nfunQfwwvI7ymGaM7C6/3G8ewvgCfS89h
mczUtTenHOyoBZWPtoRs4OI=
=MzR9
-----END PGP SIGNATURE-----

--nextPart1438587.vJ6iSbSvzF--

 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2019, SecurityGlobal.net LLC