Vulnerability CVE-2003-0459


Published: 2003-08-27   Modified: 2012-02-12

Description:
KDE Konqueror for KDE 3.1.2 and earlier does not remove authentication credentials from URLs of the "user:password@host" form in the HTTP-Referer header, which could allow remote web sites to steal the credentials for pages that link to the sites.

Vendor: KDE
Product: Konqueror 
Version:
3.1.2
3.1.1
3.1
3.0.5
3.0.3
3.0.2
3.0.1
3.0
2.2.2
2.1.1
Product: Konqueror embedded 
Version: 0.1;
Vendor: Redhat
Product: Kdelibs devel 
Version:
3.1-10
3.0.3-8
3.0.0-10
2.2-11
2.1.1-5
Product: Kdelibs 
Version:
3.1-10
3.0.0-10
2.2-11
2.1.1-5
Product: Kdebase 
Version: 3.0.3-13;
Product: Analog real-time synthesizer 
Version: 2.2-11; 2.1.1-5;
Product: Kdelibs sound 
Version: 2.2-11; 2.1.1-5;
Product: Kdelibs sound devel 
Version: 2.2-11; 2.1.1-5;

CVSS2 => (AV:N/AC:L/Au:N/C:P/I:N/A:N)

CVSS Base Score
Impact Subscore
Exploitability Subscore
5/10
2.9/10
10/10
Exploit range
Attack complexity
Authentication
Remote
Low
No required
Confidentiality impact
Integrity impact
Availability impact
Partial
None
None

 References:
http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000747
http://lists.grok.org.uk/pipermail/full-disclosure/2003-July/007300.html
http://marc.info/?l=bugtraq&m=105986238428061&w=2
http://www.debian.org/security/2003/dsa-361
http://www.kde.org/info/security/advisory-20030729-1.txt
http://www.mandriva.com/security/advisories?name=MDKSA-2003:079
http://www.redhat.com/support/errata/RHSA-2003-235.html
http://www.redhat.com/support/errata/RHSA-2003-236.html
http://www.turbolinux.com/security/TLSA-2003-45.txt
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A411

Related CVE
CVE-2018-6175
Incorrect handling of confusable characters in URL Formatter in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted domain name.
CVE-2018-6174
Integer overflows in Swiftshader in Google Chrome prior to 68.0.3440.75 potentially allowed a remote attacker to execute arbitrary code via a crafted HTML page.
CVE-2018-6173
Incorrect handling of confusable characters in URL Formatter in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted domain name.
CVE-2018-6172
Incorrect handling of confusable characters in URL Formatter in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted domain name.
CVE-2018-6170
A bad cast in PDFium in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file.
CVE-2018-6169
Lack of timeout on extension install prompt in Extensions in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to trigger installation of an unwanted extension via a crafted HTML page.
CVE-2018-6167
Incorrect handling of confusable characters in URL Formatter in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted domain name.
CVE-2018-6166
Incorrect handling of confusable characters in URL Formatter in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted domain name.

Copyright 2019, cxsecurity.com

 

Back to Top