Detections
Analytics
Oracle Linux 4 / 5 : kdelibs (ELSA-2007-0909)
medium Nessus Plugin ID 67574
Language:
Synopsis
The remote Oracle Linux host is missing one or more security updates.Description
From Red Hat Security Advisory 2007:0909 :Updated kdelibs packages that resolve several security flaws are now available for Red Hat Enterprise Linux 4 and 5.
This update has been rated as having moderate security impact by the Red Hat Security Response Team.
The kdelibs package provides libraries for the K Desktop Environment (KDE).
Two cross-site-scripting flaws were found in the way Konqueror processes certain HTML content. This could result in a malicious attacker presenting misleading content to an unsuspecting user.
(CVE-2007-0242, CVE-2007-0537)
A flaw was found in KDE JavaScript implementation. A web page containing malicious JavaScript code could cause Konqueror to crash.
(CVE-2007-1308)
A flaw was found in the way Konqueror handled certain FTP PASV commands. A malicious FTP server could use this flaw to perform a rudimentary port-scan of machines behind a user's firewall.
(CVE-2007-1564)
Two Konqueror address spoofing flaws have been discovered. It was possible for a malicious website to cause the Konqueror address bar to display information which could trick a user into believing they are at a different website than they actually are. (CVE-2007-3820, CVE-2007-4224)
Users of KDE should upgrade to these updated packages, which contain backported patches to correct these issues.
Solution
Update the affected kdelibs packages.See Also
https://oss.oracle.com/pipermail/el-errata/2007-October/000356.html
https://oss.oracle.com/pipermail/el-errata/2007-October/000357.html
Plugin Details
Severity: Medium
ID: 67574
File Name: oraclelinux_ELSA-2007-0909.nasl
Version: 1.10
Type: local
Agent: unix
Published: 7/12/2013
Updated: 1/14/2021
Supported Sensors: Continuous Assessment, Frictionless Assessment Agent, Nessus Agent, Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 6.7
CVSS v2
Risk Factor: Medium
Base Score: 6.8
Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P
Vulnerability Information
CPE: cpe:/o:oracle:linux:5, p-cpe:/a:oracle:linux:kdelibs-apidocs, cpe:/o:oracle:linux:4, p-cpe:/a:oracle:linux:kdelibs-devel, p-cpe:/a:oracle:linux:kdelibs
Required KB Items: Host/local_checks_enabled, Host/OracleLinux, Host/RedHat/release, Host/RedHat/rpm-list
Patch Publication Date: 10/8/2007
Vulnerability Publication Date: 1/29/2007
Reference Information
CVE: CVE-2007-0242, CVE-2007-0537, CVE-2007-1308, CVE-2007-1564, CVE-2007-3820, CVE-2007-4224