Bug 248537 - (CVE-2007-3820) CVE-2007-3820 Spoofing of URI possible in Konqueror's address bar
CVE-2007-3820 Spoofing of URI possible in Konqueror's address bar
Status: CLOSED DEFERRED
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
unspecified
All Linux
low Severity medium
: ---
: ---
Assigned To: Red Hat Product Security
http://www.securityfocus.com/archive/...
impact=low,source=bugtraq,reported=20...
: Security
Depends On: 290851 290861 290871 290881 293401 293411 293421 293431
Blocks:
  Show dependency treegraph
 
Reported: 2007-07-17 06:56 EDT by Lubomir Kundrak
Modified: 2007-09-17 12:24 EDT (History)
2 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2007-09-05 10:59:50 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)
Upstream patch for CVE-2007-3820 Konqueror URI spoofing (765 bytes, patch)
2007-07-17 09:15 EDT, Lubomir Kundrak
no flags Details | Diff

  None (edit)
Description Lubomir Kundrak 2007-07-17 06:56:33 EDT
Description of problem:

An URI that appears in the address bar is scrolled to the right,
and thus a long URI padded with whitespace can be used to trick
user.

Version-Release number of selected component (if applicable):

        CVE-2007-3820 Probably Affects: RHEL2.1
        CVE-2007-3820 Probably Affects: RHEL3
        CVE-2007-3820 Affects: RHEL4
        CVE-2007-3820 Affects: RHEL5
        CVE-2007-3820 Affects: FC6
        CVE-2007-3820 Affects: FC7

Steps to Reproduce:
1. Visit http://alt.swiecki.net/oper1.html

tp://alt.swiecki.net/oper1.html with konqueror

Actual results:

http://alt.swiecki.net/konq.png

Additional info:

An data: URI (with inline HTML) can contain real spaces, not just %20.
Comment 1 Lubomir Kundrak 2007-07-17 09:15:42 EDT
Created attachment 159428 [details]
Upstream patch for CVE-2007-3820 Konqueror URI spoofing
Comment 2 Tomas Hoger 2007-08-14 10:06:56 EDT
Upstream patch in #c1 creates new problem, which got CVE name CVE-2007-4225.
Comment 3 Tomas Hoger 2007-08-20 06:36:05 EDT
KDE security advisory targeting CVE-2007-3820, CVE-2007-4224 and CVE-2007-4225
with references to official upstream patches:

http://www.kde.org/info/security/advisory-20070816-1.txt
Comment 4 Ngo Than 2007-08-30 13:14:17 EDT
it's only affected in RHEL-4/RHEL5, but not in RHEL-2.1 and RHEL-3
Comment 6 Mark J. Cox (Product Security) 2007-09-05 10:59:50 EDT
this is a low severity flaw which does not trigger the need for a security
update to kde.  We will fix this issue when other issues of higher severity
trigger a kde security update.

Note You need to log in before you can comment on or make changes to this bug.