kpac/script.cpp in KDE kio before 5.32 and kdelibs before 4.14.30 calls the PAC FindProxyForURL function with a full https URL (potentially including Basic Authentication credentials, a query string, or PATH_INFO), which allows remote attackers to obtain sensitive information via a crafted PAC file.

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - kdelibs: kssl incorrect verification of SSL certificate with NUL in subjectAltName (CVE-2009-2702)

  - kf5-kio, kdelibs: Information Leak when accessing https when using a malicious PAC file (CVE-2017-6410)

  - kioslave/http/http.cpp in KIO in kdelibs 4.10.3 and earlier allows attackers to discover credentials via a     crafted request that triggers an internal server error, which includes the username and password in an     error message. (CVE-2013-2074)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - kdelibs: prints passwords contained in HTTP URLs in error messages (CVE-2013-2074)

  - kf5-kio, kdelibs: Information Leak when accessing https when using a malicious PAC file (CVE-2017-6410)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched.

  - kf5-kio, kdelibs: Information Leak when accessing https when using a malicious PAC file (CVE-2017-6410)

Note that Nessus has not tested for this issue but has instead relied on the package manager's report that the package is installed.

Several vulnerabilities were discovered in kde4libs, the core libraries for all KDE 4 applications. The Common Vulnerabilities and Exposures project identifies the following problems :

CVE-2017-6410

Itzik Kotler, Yonatan Fridburg and Amit Klein of Safebreach Labs reported that URLs are not sanitized before passing them to FindProxyForURL, potentially allowing a remote attacker to obtain sensitive information via a crafted PAC file.

CVE-2017-8422

Sebastian Krahmer from SUSE discovered that the KAuth framework contains a logic flaw in which the service invoking dbus is not properly checked. This flaw allows spoofing the identity of the caller and gaining root privileges from an unprivileged account.

CVE-2013-2074

It was discovered that KIO would show web authentication credentials in some error cases.

For Debian 7 'Wheezy', these problems have been fixed in version 4:4.8.4-4+deb7u3.

We recommend that you upgrade your kde4libs packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several vulnerabilities were discovered in kde4libs, the core libraries for all KDE 4 applications. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2017-6410     Itzik Kotler, Yonatan Fridburg and Amit Klein of     Safebreach Labs reported that URLs are not sanitized     before passing them to FindProxyForURL, potentially     allowing a remote attacker to obtain sensitive     information via a crafted PAC file.

  - CVE-2017-8422     Sebastian Krahmer from SUSE discovered that the KAuth     framework contains a logic flaw in which the service     invoking dbus is not properly checked. This flaw allows     spoofing the identity of the caller and gaining root     privileges from an unprivileged account.

This update for kdelibs4, kio fixes the following issues :

  - CVE-2017-6410: Information Leak when accessing https     when using a malicious PAC file (boo#1027520)

Security fix for CVE-2017-6410

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This kdelibs3 (KDE 3 compatibility libraries) update fixes the security issues :

  - CVE-2016-6232 (karchive): Extraction of tar files     possible to arbitrary system locations

  - CVE-2017-6410 (kio): Information Leak when accessing     https when using a malicious PAC file

for the KDE 3 compatibility libraries. (Security updates for KDE Frameworks 5 (kf5-karchive resp. kf5-kio) and for the KDE 4 compatibility libraries (kdelibs 4) have already been submitted.)

In addition, the KDE 3 compatibility version of KCrash was modified to use the DrKonqi from Plasma 5 rather than from kde-runtime 4. (The original KDE 3 DrKonqi was already dropped years ago.) The kde-runtime 4 DrKonqi is not installed by default and will be removed entirely in future Fedora versions, the Plasma 5 version of DrKonqi can also be used for legacy applications.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 14.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-3223-1 advisory.

    Itzik Kotler, Yonatan Fridburg, and Amit Klein discovered that KDE-Libs incorrectly handled certain PAC     files. A remote attacker could possibly use this issue to obtain sensitive information.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
198417	RHEL 5 : kdelibs (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	medium
198408	RHEL 6 : kdelibs (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	medium
198370	RHEL 7 : kdelibs (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	medium
100431	Debian DLA-952-1 : kde4libs security update	Nessus	Debian Local Security Checks	high
100163	Debian DSA-3849-1 : kde4libs - security update	Nessus	Debian Local Security Checks	high
97715	openSUSE Security Update : kdelibs4 / kio (openSUSE-2017-334)	Nessus	SuSE Local Security Checks	medium
97681	Fedora 24 : 6:kdelibs (2017-b011e8c922)	Nessus	Fedora Local Security Checks	medium
97678	Fedora 25 : kdelibs3 (2017-4f4eef4791)	Nessus	Fedora Local Security Checks	high
97672	Fedora 24 : kdelibs3 (2017-01eed6fe8c)	Nessus	Fedora Local Security Checks	high
97658	Ubuntu 14.04 LTS : KDE-Libs vulnerability (USN-3223-1)	Nessus	Ubuntu Local Security Checks	medium
97543	Fedora 25 : kf5-kio (2017-f9ab92fa6c)	Nessus	Fedora Local Security Checks	medium
97534	Fedora 25 : 6:kdelibs (2017-53338ece0c)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2017-6410

medium

Tenable Plugins

medium

medium

medium

high

high

medium

medium

high

high

medium

medium

medium