KDE Konqueror 3.5.7 allows remote attackers to spoof the URL address bar by calling setInterval with a small interval and changing the window.location property.

From Red Hat Security Advisory 2007:0909 :

Updated kdelibs packages that resolve several security flaws are now available for Red Hat Enterprise Linux 4 and 5.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

The kdelibs package provides libraries for the K Desktop Environment (KDE).

Two cross-site-scripting flaws were found in the way Konqueror processes certain HTML content. This could result in a malicious attacker presenting misleading content to an unsuspecting user.
(CVE-2007-0242, CVE-2007-0537)

A flaw was found in KDE JavaScript implementation. A web page containing malicious JavaScript code could cause Konqueror to crash.
(CVE-2007-1308)

A flaw was found in the way Konqueror handled certain FTP PASV commands. A malicious FTP server could use this flaw to perform a rudimentary port-scan of machines behind a user's firewall.
(CVE-2007-1564)

Two Konqueror address spoofing flaws have been discovered. It was possible for a malicious website to cause the Konqueror address bar to display information which could trick a user into believing they are at a different website than they actually are. (CVE-2007-3820, CVE-2007-4224)

Users of KDE should upgrade to these updated packages, which contain backported patches to correct these issues.

From Red Hat Security Advisory 2007:0905 :

Updated kdebase packages that resolve several security flaws are now available for Red Hat Enterprise Linux 4 and 5.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

The kdebase packages provide the core applications for KDE, the K Desktop Environment. These core packages include Konqueror, the web browser and file manager.

These updated packages address the following vulnerabilities :

Kees Huijgen found a flaw in the way KDM handled logins when autologin and 'shutdown with password' were enabled. A local user would have been able to login via KDM as any user without requiring a password.
(CVE-2007-4569)

Two Konqueror address spoofing flaws were discovered. A malicious website could spoof the Konqueror address bar, tricking a victim into believing the page was from a different site. (CVE-2007-3820, CVE-2007-4224)

Users of KDE should upgrade to these updated packages, which contain backported patches to correct these issues.

Two cross-site-scripting flaws were found in the way Konqueror processes certain HTML content. This could result in a malicious attacker presenting misleading content to an unsuspecting user.
(CVE-2007-0242, CVE-2007-0537)

A flaw was found in KDE JavaScript implementation. A web page containing malicious JavaScript code could cause Konqueror to crash.
(CVE-2007-1308)

A flaw was found in the way Konqueror handled certain FTP PASV commands. A malicious FTP server could use this flaw to perform a rudimentary port-scan of machines behind a user's firewall.
(CVE-2007-1564)

Two Konqueror address spoofing flaws have been discovered. It was possible for a malicious website to cause the Konqueror address bar to display information which could trick a user into believing they are at a different website than they actually are. (CVE-2007-3820, CVE-2007-4224)

Kees Huijgen found a flaw in the way KDM handled logins when autologin and 'shutdown with password' were enabled. A local user would have been able to login via KDM as any user without requiring a password.
(CVE-2007-4569)

Two Konqueror address spoofing flaws were discovered. A malicious website could spoof the Konqueror address bar, tricking a victim into believing the page was from a different site. (CVE-2007-3820, CVE-2007-4224)

Users could log in as root without having to enter the password if auto login was enabled and if kdm was configured to require the root passwort to shutdown the system. (CVE-2007-4569)

JavaScript code could modify the URL in the address bar to make the currently displayed website appear to come from a different site.
(CVE-2007-4224)

It was discovered that Konqueror could be tricked into displaying incorrect URLs. Remote attackers could exploit this to increase their chances of tricking a user into visiting a phishing URL, which could lead to credential theft.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- Tue Oct 2 2007 Than Ngo <than at redhat.com> -     6:3.5.7-13.1

    - rh#299731, CVE-2007-4569

    - Wed Aug 15 2007 Rex Dieter       <rdieter[AT]fedoraproject.org> 6:3.5.7-13

    - CVE-2007-3820, CVE-2007-4224, CVE-2007-4225

    - License: GPLv2

    - Requires: kdelibs3(-devel)

    - Fri Jul 20 2007 Rex Dieter       <rdieter[AT]fedoraproject.org> - 6:3.5.7-12

    - fix unpackaged files

    - Fri Jul 20 2007 Rex Dieter       <rdieter[AT]fedoraproject.org> - 6:3.5.7-9

    - %ifnarch s390 s390x: BR: lm_sensors

    - Thu Jul 19 2007 Rex Dieter       <rdieter[AT]fedoraproject.org> - 6:3.5.7-7

    - omit dirs owned by kde-filesystem

    - Mon Jul 2 2007 Than Ngo <than at redhat.com> -       6:3.5.7-6

    - fix bz#244906

    - Wed Jun 20 2007 Rex Dieter       <rdieter[AT]fedoraproject.org> - 6:3.5.7-5

    - Provides: kdebase3(-devel)

    - Wed Jun 20 2007 Rex Dieter       <rdieter[AT]fedoraproject.org> - 6:3.5.7-4

    - -devel: Requires: %name...

    - portability++

    - Fri Jun 15 2007 Rex Dieter       <rdieter[AT]fedoraproject.org> - 6:3.5.7-3

    - specfile portability

    - Mon Jun 11 2007 Rex Dieter       <rdieter[AT]fedoraproject.org> - 6:3.5.7-2

    - fix BR: kdelibs-devel

    - cleanup Req's wrt kde-settings

    - Mon Jun 11 2007 Than Ngo <than at redhat.com> -       6:3.5.7-1.fc7.1

    - remove kdebase-3.4.2-npapi-64bit-fixes.patch, it's       included in new upstream

  - Wed Jun 6 2007 Than Ngo <than at redhat.com> -     6:3.5.7-0.1

    - 3.5.7

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update primarily addresses security issues around URL spoofing.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update primarily addresses problems with URL spoofing and consolekit/session permissions.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Users could log in as root without having to enter the password if auto login was enabled and if kdm was configured to require the root passwort to shutdown the system (CVE-2007-4569).

JavaScript code could modify the URL in the address bar to make the currently displayed website appear to come from a different site (CVE-2007-4224).

Updated kdelibs packages that resolve several security flaws are now available for Red Hat Enterprise Linux 4 and 5.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

The kdelibs package provides libraries for the K Desktop Environment (KDE).

Two cross-site-scripting flaws were found in the way Konqueror processes certain HTML content. This could result in a malicious attacker presenting misleading content to an unsuspecting user.
(CVE-2007-0242, CVE-2007-0537)

A flaw was found in KDE JavaScript implementation. A web page containing malicious JavaScript code could cause Konqueror to crash.
(CVE-2007-1308)

A flaw was found in the way Konqueror handled certain FTP PASV commands. A malicious FTP server could use this flaw to perform a rudimentary port-scan of machines behind a user's firewall.
(CVE-2007-1564)

Two Konqueror address spoofing flaws have been discovered. It was possible for a malicious website to cause the Konqueror address bar to display information which could trick a user into believing they are at a different website than they actually are. (CVE-2007-3820, CVE-2007-4224)

Users of KDE should upgrade to these updated packages, which contain backported patches to correct these issues.

Updated kdebase packages that resolve several security flaws are now available for Red Hat Enterprise Linux 4 and 5.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

The kdebase packages provide the core applications for KDE, the K Desktop Environment. These core packages include Konqueror, the web browser and file manager.

These updated packages address the following vulnerabilities :

Kees Huijgen found a flaw in the way KDM handled logins when autologin and 'shutdown with password' were enabled. A local user would have been able to login via KDM as any user without requiring a password.
(CVE-2007-4569)

Two Konqueror address spoofing flaws were discovered. A malicious website could spoof the Konqueror address bar, tricking a victim into believing the page was from a different site. (CVE-2007-3820, CVE-2007-4224)

Users of KDE should upgrade to these updated packages, which contain backported patches to correct these issues.

The remote Redhat Enterprise Linux 4 / 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2007:0909 advisory.

    The kdelibs package provides libraries for the K Desktop Environment (KDE).

    Two cross-site-scripting flaws were found in the way Konqueror processes     certain HTML content. This could result in a malicious attacker presenting     misleading content to an unsuspecting user. (CVE-2007-0242, CVE-2007-0537)

    A flaw was found in KDE JavaScript implementation.  A web page containing     malicious JavaScript code could cause Konqueror to crash. (CVE-2007-1308)

    A flaw was found in the way Konqueror handled certain FTP PASV commands.
    A malicious FTP server could use this flaw to perform a rudimentary     port-scan of machines behind a user's firewall. (CVE-2007-1564)

    Two Konqueror address spoofing flaws have been discovered. It was     possible for a malicious website to cause the Konqueror address bar to     display information which could trick a user into believing they are at a     different website than they actually are. (CVE-2007-3820, CVE-2007-4224)

    Users of KDE should upgrade to these updated packages, which contain     backported patches to correct these issues.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora Core host is missing one or more security updates :

kdebase-3.5.7-1.fc6 :

  - Tue Oct 2 2007 Than Ngo <than at redhat.com> -     6:3.5.7-1.fc6

    - CVE-2007-4224, CVE-2007-4225, CVE-2007-3820

    - rh#299741, CVE-2007-4569

    - Mon Jul 2 2007 Than Ngo <than at redhat.com> -       6:3.5.7-0.fc6.2

    - fix #244906

kdelibs-3.5.7-1.fc6 :

  - Tue Oct 2 2007 Than Ngo <than at redhat.com> -     6:3.5.7-1.fc6

    - CVE-2007-4224, CVE-2007-3820 konqueror address bar       spoofing

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

New kdebase packages are available for Slackware 12.0 to fix security issues. A long URL padded with spaces could be used to display a false URL in Konqueror's addressbar, and KDM when used with no-password login could be tricked into logging a different user in without a password. This is not the way KDM is configured in Slackware by default, somewhat mitigating the impact of this issue.

The KDE development team reports :

The Konqueror address bar is vulnerable to spoofing attacks that are based on embedding white spaces in the url. In addition the address bar could be tricked to show an URL which it is intending to visit for a short amount of time instead of the current URL.

konqueror/konq_combo.cc in Konqueror 3.5.7 allows remote attackers to spoof the data: URI scheme in the address bar via a long URI with trailing whitespace, which prevents the beginning of the URI from being displayed. (CVE-2007-3820)

KDE Konqueror 3.5.7 allows remote attackers to spoof the URL address bar by calling setInterval with a small interval and changing the window.location property. (CVE-2007-4224)

Visual truncation vulnerability in KDE Konqueror 3.5.7 allows remote attackers to spoof the URL address bar via an http URI with a large amount of whitespace in the user/password portion. (CVE-2007-4225)

Updated packages fix these issues.

ID	Name	Product	Family	Severity
67574	Oracle Linux 4 / 5 : kdelibs (ELSA-2007-0909)	Nessus	Oracle Linux Local Security Checks	medium
67573	Oracle Linux 4 / 5 : kdebase (ELSA-2007-0905)	Nessus	Oracle Linux Local Security Checks	medium
60263	Scientific Linux Security Update : kdelibs on SL5.x, SL4.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	medium
60262	Scientific Linux Security Update : kdebase on SL5.x, SL4.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	medium
29429	SuSE 10 Security Update : KDE (ZYPP Patch Number 4433)	Nessus	SuSE Local Security Checks	medium
28106	Ubuntu 6.06 LTS / 6.10 / 7.04 : kdebase, kdelibs vulnerabilities (USN-502-1)	Nessus	Ubuntu Local Security Checks	medium
27769	Fedora 7 : kdebase-3.5.7-13.1.fc7 (2007-2361)	Nessus	Fedora Local Security Checks	medium
27729	Fedora 7 : kdebase-3.5.7-13.fc7 (2007-1700)	Nessus	Fedora Local Security Checks	medium
27728	Fedora 7 : kdelibs-3.5.7-20.fc7 (2007-1699)	Nessus	Fedora Local Security Checks	medium
27217	openSUSE 10 Security Update : fileshareset (fileshareset-4454)	Nessus	SuSE Local Security Checks	medium
26974	CentOS 4 / 5 : kdelibs (CESA-2007:0909)	Nessus	CentOS Local Security Checks	medium
26973	CentOS 4 / 5 : kdebase (CESA-2007:0905)	Nessus	CentOS Local Security Checks	medium
26952	RHEL 4 / 5 : kdelibs (RHSA-2007:0909)	Nessus	Red Hat Local Security Checks	medium
26951	RHEL 4 / 5 : kdebase (RHSA-2007:0905)	Nessus	Red Hat Local Security Checks	medium
26935	Fedora Core 6 : kdebase-3.5.7-1.fc6 / kdelibs-3.5.7-1.fc6 (2007-716)	Nessus	Fedora Local Security Checks	medium
26113	Slackware 12.0 : kdebase, kdelibs (SSA:2007-264-01)	Nessus	Slackware Local Security Checks	medium
26085	FreeBSD : konquerer -- address bar spoofing (14ad2a28-66d2-11dc-b25f-02e0185f8d72)	Nessus	FreeBSD Local Security Checks	medium
26008	Mandrake Linux Security Advisory : konqueror (MDKSA-2007:176)	Nessus	Mandriva Local Security Checks	medium

Detections

Analytics

CVE-2007-4224

high

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium