Red Hat Bugzilla – Bug 129228
CAN-2004-0746 Konqueror Cross-Domain Cookie Injection
Last modified: 2007-11-30 17:07:03 EST
1. Systems affected:
All versions of KDE up to KDE 3.2.3 inclusive.
WESTPOINT internet reconnaissance services alerted the KDE
security team that the KDE web browser Konqueror allows websites
to set cookies for certain country specific secondary top
Web sites operating under the affected domains can set HTTP
cookies in such a way that the Konqueror web browser will send
to all other web sites operating under the same domain.
A malicious website can use this as part of a session fixation
attack. See e.g. http://www.acros.si/papers/session_fixation.pdf
Affected are all country specific secondary top level domains
that use more than 2 characters in the secondary part of the domain
name and that use a secondary part other than com, net, mil, org, gov,
edu or int. Examples of affected domains are .ltd.uk, .plc.uk
and .firm.in It should be noted that popular domains such as
.co.uk, .co.in and .com are NOT affected.
Embargoed until Aug 20
This issue should also affect RHEL2.1
In order to verify this issue, we're going to have to jump through
some pretty big hoops.
it's fixed in kdelibs-3.1.3-6.6/kdebase-3.1.3-5.4 for RHEL3
for 2.1AS it still needs doing backport.
public, removing embargo.
An errata has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on the solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.