Bug 129228 - CAN-2004-0746 Konqueror Cross-Domain Cookie Injection
CAN-2004-0746 Konqueror Cross-Domain Cookie Injection
Status: CLOSED ERRATA
Product: Red Hat Enterprise Linux 3
Classification: Red Hat
Component: kdelibs (Show other bugs)
3.0
All Linux
medium Severity medium
: ---
: ---
Assigned To: Ngo Than
: Security
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2004-08-05 09:41 EDT by Josh Bressers
Modified: 2007-11-30 17:07 EST (History)
1 user (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2004-10-04 11:28:45 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Josh Bressers 2004-08-05 09:41:23 EDT
1. Systems affected:

        All versions of KDE up to KDE 3.2.3 inclusive.


2. Overview:

        WESTPOINT internet reconnaissance services alerted the KDE
        security team that the KDE web browser Konqueror allows websites
        to set cookies for certain country specific secondary top
level domains.


3. Impact:

        Web sites operating under the affected domains can set HTTP
        cookies in such a way that the Konqueror web browser will send
them
        to all other web sites operating under the same domain.
        A malicious website can use this as part of a session fixation
        attack. See e.g. http://www.acros.si/papers/session_fixation.pdf

        Affected are all country specific secondary top level domains
that use more than 2 characters in the secondary part of the domain
name and that use a secondary part other than com, net, mil, org, gov,
       edu or int. Examples of affected domains are .ltd.uk, .plc.uk
and        .firm.in It should be noted that popular domains such as
.co.uk, .co.in and .com are NOT affected.



Embargoed until Aug 20
Comment 1 Josh Bressers 2004-08-05 09:42:06 EDT
This issue should also affect RHEL2.1

In order to verify this issue, we're going to have to jump through
some pretty big hoops.
Comment 2 Ngo Than 2004-08-10 14:54:34 EDT
it's fixed in kdelibs-3.1.3-6.6/kdebase-3.1.3-5.4 for RHEL3

for 2.1AS it still needs doing backport.
Comment 3 Josh Bressers 2004-08-23 10:08:46 EDT
public, removing embargo.
Comment 4 Josh Bressers 2004-10-04 11:28:45 EDT
An errata has been issued which should help the problem 
described in this bug report. This report is therefore being 
closed with a resolution of ERRATA. For more information
on the solution and/or where to find the updated files, 
please follow the link below. You may reopen this bug report 
if the solution does not work for you.

http://rhn.redhat.com/errata/RHSA-2004-412.html
Comment 5 Josh Bressers 2004-10-05 09:39:02 EDT
An errata has been issued which should help the problem 
described in this bug report. This report is therefore being 
closed with a resolution of ERRATA. For more information
on the solution and/or where to find the updated files, 
please follow the link below. You may reopen this bug report 
if the solution does not work for you.

http://rhn.redhat.com/errata/RHSA-2004-412.html

Note You need to log in before you can comment on or make changes to this bug.