Bug 248537 (CVE-2007-3820)

Summary: CVE-2007-3820 Spoofing of URI possible in Konqueror's address bar
Product: [Other] Security Response Reporter: Lubomir Kundrak <lkundrak>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED DEFERRED QA Contact:
Severity: medium Docs Contact:
Priority: low    
Version: unspecifiedCC: kreilly, than
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
URL: http://www.securityfocus.com/archive/1/archive/1/473712/100/0/threaded
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2007-09-05 14:59:50 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 290851, 290861, 290871, 290881, 293401, 293411, 293421, 293431    
Bug Blocks:    
Attachments:
Description Flags
Upstream patch for CVE-2007-3820 Konqueror URI spoofing none

Description Lubomir Kundrak 2007-07-17 10:56:33 UTC
Description of problem:

An URI that appears in the address bar is scrolled to the right,
and thus a long URI padded with whitespace can be used to trick
user.

Version-Release number of selected component (if applicable):

        CVE-2007-3820 Probably Affects: RHEL2.1
        CVE-2007-3820 Probably Affects: RHEL3
        CVE-2007-3820 Affects: RHEL4
        CVE-2007-3820 Affects: RHEL5
        CVE-2007-3820 Affects: FC6
        CVE-2007-3820 Affects: FC7

Steps to Reproduce:
1. Visit http://alt.swiecki.net/oper1.html

tp://alt.swiecki.net/oper1.html with konqueror

Actual results:

http://alt.swiecki.net/konq.png

Additional info:

An data: URI (with inline HTML) can contain real spaces, not just %20.

Comment 1 Lubomir Kundrak 2007-07-17 13:15:42 UTC
Created attachment 159428 [details]
Upstream patch for CVE-2007-3820 Konqueror URI spoofing

Comment 2 Tomas Hoger 2007-08-14 14:06:56 UTC
Upstream patch in #c1 creates new problem, which got CVE name CVE-2007-4225.

Comment 3 Tomas Hoger 2007-08-20 10:36:05 UTC
KDE security advisory targeting CVE-2007-3820, CVE-2007-4224 and CVE-2007-4225
with references to official upstream patches:

http://www.kde.org/info/security/advisory-20070816-1.txt

Comment 4 Than Ngo 2007-08-30 17:14:17 UTC
it's only affected in RHEL-4/RHEL5, but not in RHEL-2.1 and RHEL-3

Comment 6 Mark J. Cox 2007-09-05 14:59:50 UTC
this is a low severity flaw which does not trigger the need for a security
update to kde.  We will fix this issue when other issues of higher severity
trigger a kde security update.