--------------------------------------------------------------------------
Debian Security Advisory DSA 361-1                     security@debian.org 
Debian -- Security Information                              Matt Zimmerman
August 1st, 2003                         Debian -- Debian security FAQ 
--------------------------------------------------------------------------

Package        : kdelibs
Vulnerability  : several
Problem-Type   : remote
Debian-specific: no
CVE Ids        : CAN-2003-0459, CAN-2003-0370

Two vulnerabilities were discovered in kdelibs:

- CAN-2003-0459: KDE Konqueror for KDE 3.1.2 and earlier does not
  remove authentication credentials from URLs of the
  "user:password@host" form in the HTTP-Referer header, which could
  allow remote web sites to steal the credentials for pages that link
  to the sites.

- CAN-2003-0370: Konqueror Embedded and KDE 2.2.2 and earlier does not
  validate the Common Name (CN) field for X.509 Certificates, which
  could allow remote attackers to spoof certificates via a
  man-in-the-middle attack.

These vulnerabilities are described in the following security
advisories from KDE:
 
https://kde.org/info/security/advisory-20030729-1.txt 
https://kde.org/info/security/advisory-20030602-1.txt

For the current stable distribution (woody) these problems have been
fixed in version 2.2.2-13.woody.8.

For the unstable distribution (sid) these problems have been fixed in
version 4:3.1.3-1.

We recommend that you update your kdelibs package.

Upgrade Instructions
--------------------

wget url
        will fetch the file for you
dpkg -i file.deb
        will install the referenced file.

If you are using the apt-get package manager, use the line for
sources.list as given below:

apt-get update
        will update the internal database
apt-get upgrade
        will install corrected packages

You may use an automated update by adding the resources from the
footer to the proper configuration.

Debian GNU/Linux 3.0 alias woody
--------------------------------

  Source archives:

      
      Size/MD5 checksum:     1353 5c815a67ccb9603faa9a8eb966402221
      
      Size/MD5 checksum:    56799 f193bbbbe086c4d721b1da897e245c5f
      
      Size/MD5 checksum:  6396699 7a9277a2e727821338f751855c2ce5d3

  Architecture independent components:

      
      Size/MD5 checksum:  2564214 b05746e361304cc132ba11711b55f7a3

  Alpha architecture:

      
      Size/MD5 checksum:   757264 fa6f0c3eb1c83241d85c1d893384a195
      
      Size/MD5 checksum:  7532294 15954f4cb9b69375d3cce2568712711a
      
      Size/MD5 checksum:   137266 3d40312c8cb68a694e9099943fcbe07a
      
      Size/MD5 checksum:   201840 f70cdcb31526bf907e4d1473be008b2a
      
      Size/MD5 checksum:  1022220 92a0bd302d8a032deea14f0a0a098ac1
      
      Size/MD5 checksum:  1029292 f323f737e7f004901968f3c55fcbe4f0
      
      Size/MD5 checksum:   198074 c93cd4e5e1d055cbc5ba21e6c0492991
      
      Size/MD5 checksum:   174586 a59200be90a136177d7ca2d2e95e755a
      
      Size/MD5 checksum:   177924 79f4eefc4d91fc4486cef938cc53c4da
      
      Size/MD5 checksum:    37100 6666a0f271a4b8419be5f0a3253c7d76

  ARM architecture:

      
      Size/MD5 checksum:   743528 80af5e2c904de9884538dd501324fd68
      
      Size/MD5 checksum:  6589168 1a0c58d52d0f2ce47ccc949515ea8d11
      
      Size/MD5 checksum:   104432 c0792835b59698a172f02d169e8f35ed
      
      Size/MD5 checksum:   186426 0b4adc69f78802ae4785324a389af2ed
      
      Size/MD5 checksum:   651612 263bd14c2e2efbcb046599ead20ccda7
      
      Size/MD5 checksum:   655244 a218efa916ef08c4761ee37717ac28c4
      
      Size/MD5 checksum:   155386 8b7213a904bffe4b586e3ef1a23272b3
      
      Size/MD5 checksum:   124670 94011575cb718615027bd874f4d19782
      
      Size/MD5 checksum:   127760 2c2b46294b71d0e58938f5c4dc677894
      
      Size/MD5 checksum:    37106 53018863a02bbf8527219b57e64b8cf9

  Intel IA-32 architecture:

      
      Size/MD5 checksum:   742862 d694169bd78c22556e7826e6743671ab
      
      Size/MD5 checksum:  6618286 93a23c4e4b60c2d22751a1d4e5e3bd44
      
      Size/MD5 checksum:   105992 93dbd645f4a1df07aa6dd59d15c78c06
      
      Size/MD5 checksum:   182852 a40d3071a7ac0dda38f8cb6c7c16089d
      
      Size/MD5 checksum:   625038 2eb65cf5e415b1cb4575dbd280913abf
      
      Size/MD5 checksum:   629376 bd686dffac6f128bf148073dd7cc5b22
      
      Size/MD5 checksum:   154760 3e1e8471787a474f6f28a2ac6f5650bc
      
      Size/MD5 checksum:   123322 43c58d4502adbe3acbcde52bfb759e8e
      
      Size/MD5 checksum:   126424 062e28ea18e9aa2a97175f39096862cb
      
      Size/MD5 checksum:    37102 bda10467f1b18c7484e4ac1aae586cd0

  Intel IA-64 architecture:

      
      Size/MD5 checksum:   767558 3ca9c93a1b628aba1c48f9512efb0450
      
      Size/MD5 checksum:  8841368 b5fff89ff6261d43781c8766aa5d7598
      
      Size/MD5 checksum:   153600 51e682a99dcdd400857f5837168ee701
      
      Size/MD5 checksum:   256878 bf044e843b5a7dd4739ceb11828bcda9
      
      Size/MD5 checksum:  1045290 70bc69ea7ddd37b6971a83099e87cd15
      
      Size/MD5 checksum:  1050638 a1f471af126b41976f951680ee76ffb8
      
      Size/MD5 checksum:   199370 857ba011cd3a08d9124040da8ec6da14
      
      Size/MD5 checksum:   185444 e5220a9bb8ad3798c31a5990a7857b78
      
      Size/MD5 checksum:   190906 51eb58ce68471eb4c69a31fecda3c4d8
      
      Size/MD5 checksum:    37096 541900e17a8c8029f45fca6696ddb028

  HP Precision architecture:

      
      Size/MD5 checksum:   749598 6851da3fa2542f371f2f0e75da214aa2
      
      Size/MD5 checksum:  7343564 b0183421a4fd5ac77d0dde735e86ba6c
      
      Size/MD5 checksum:   117306 67ba5d8cea098f5e41040fd0e72b5b02
      
      Size/MD5 checksum:   217796 837e91368600cc315d838b6395ea33c1
      
      Size/MD5 checksum:  1111424 36e98fa4aae1dcbc922f19e64f866053
      
      Size/MD5 checksum:  1115322 9b08a77ed1bad67d30069413d2e0fe30
      
      Size/MD5 checksum:   207342 0eab8c26829e938578d9034f4e1e2d46
      
      Size/MD5 checksum:   171824 4752bcacbe1907803d70790119fdcc60
      
      Size/MD5 checksum:   175920 6d390d3f27e2ee266ee1c35f5c6ed4d4
      
      Size/MD5 checksum:    37102 2b13f6b456878bfc80aec171bbd25c38

  Motorola 680x0 architecture:

      
      Size/MD5 checksum:   739972 fd777221ccb53ea896b867fe0ef3caef
      
      Size/MD5 checksum:  6483984 48c7ce7a820cd2edd220e064e9c06eef
      
      Size/MD5 checksum:   103526 467cbbfa84eedec93c9ae401b0901706
      
      Size/MD5 checksum:   178436 b9f9f61bdaf437e0257fd17f004b5a65
      
      Size/MD5 checksum:   628656 ca0418d695f53e38621d3226370fe6fc
      
      Size/MD5 checksum:   633070 ef87665402f954b01ce11ed52702108e
      
      Size/MD5 checksum:   151010 cf006ab6d66435ff7ad023f3f14f8800
      
      Size/MD5 checksum:   120656 263d7d1be4bfe02281fb05ff9e692e70
      
      Size/MD5 checksum:   123560 f600fefbaa24632d3b3a9c9dbfd85ead
      
      Size/MD5 checksum:    37122 dbc0802db996370b8f614f8753e70889

  Big endian MIPS architecture:

      
      Size/MD5 checksum:   739784 70629cb3e43480fe50b30eb5322c9612
      
      Size/MD5 checksum:  6283246 4ee744d88e2a93cc62dfbfc651cfe09c
      
      Size/MD5 checksum:   106762 b6addf954e89ccd8e29ecf345c64d8d2
      
      Size/MD5 checksum:   160934 346c6e12177f10b4298f114e5b2b1bd3
      
      Size/MD5 checksum:   620766 f7049ef8edb1eaca7438dc1cfeedffc3
      
      Size/MD5 checksum:   624932 fe0372bc4f888e003d09caf7f10120a0
      
      Size/MD5 checksum:   175704 ba9cf46f91e5a5d14e23d1c5094ddfdd
      
      Size/MD5 checksum:   124128 813bcadaa332e9aa789d310721d7d8c3
      
      Size/MD5 checksum:   127166 f49ad75dea8beebafc09ee9ed17cc6ff
      
      Size/MD5 checksum:    37108 28faaa11ff5480773306c3f6178ea11a

  Little endian MIPS architecture:

      
      Size/MD5 checksum:   739092 3d10cade157a3f4bde0602f64b0ff300
      
      Size/MD5 checksum:  6189916 75c94121e9b8d379f1df07d203f29cd3
      
      Size/MD5 checksum:   105754 b27b868206dbbd749313ddd037d125ef
      
      Size/MD5 checksum:   159154 4dcc6e9fa704f7e9397f14ccc46ce2ad
      
      Size/MD5 checksum:   613612 020928718d250e5c92d4be96a58596fd
      
      Size/MD5 checksum:   617226 276481a73f6a22407a77154cec8136a9
      
      Size/MD5 checksum:   174976 96f38b7225ae2b5024aa0011dc29ac5b
      
      Size/MD5 checksum:   123152 4a6cf2f5fcea212b268812f17f680294
      
      Size/MD5 checksum:   126146 738a00cff0c87ce1480040a1d90fe483
      
      Size/MD5 checksum:    37104 7f54ce8415003d0b717c929b41e8bad8

  PowerPC architecture:

      
      Size/MD5 checksum:   740724 b5e1f0c81b55701ec79a9a74c9dc80c8
      
      Size/MD5 checksum:  6726456 50193f6730f043cfd61165791a41e1b1
      
      Size/MD5 checksum:   105866 7e721119d8c731ff17a0ece3fedf5838
      
      Size/MD5 checksum:   182522 9dac0701f1f480965806fff1fa35c33f
      
      Size/MD5 checksum:   691038 e8e31893f2385221b509e151bd01bcd2
      
      Size/MD5 checksum:   694430 cb1a09d7d22fb1ecec69e7a69c57eaf2
      
      Size/MD5 checksum:   153674 6817250ad139553026bd59854803ce6b
      
      Size/MD5 checksum:   127468 97fd8d4981c703f3af03e55b3e76645a
      
      Size/MD5 checksum:   130392 fc5c70dc535fb40e96df88d65d9b2e30
      
      Size/MD5 checksum:    37102 11ea385aa94147a7ce7361e5bd16c926

  IBM S/390 architecture:

      
      Size/MD5 checksum:   742222 e43b2f96fab3f2eb8799c8fbdc8cad0b
      
      Size/MD5 checksum:  6739634 08cfb20b521e6846e04bf9355c7b991a
      
      Size/MD5 checksum:   110408 ca03d603ad2a470b3a894aeabeec73f0
      
      Size/MD5 checksum:   176894 d674123f0e6efe0b670f1df90b9b9ec8
      
      Size/MD5 checksum:   642158 6f35ad2827c5cf446332afbf7264c50c
      
      Size/MD5 checksum:   647300 6644e9c73c6a88098c46c1b29bf4e256
      
      Size/MD5 checksum:   151336 592491f74265d1615083dc4c4ed7fea4
      
      Size/MD5 checksum:   129832 99e927cb9e8c491fe537703c948face8
      
      Size/MD5 checksum:   133278 0461b7e0b431a64474761d14fab9b6c6
      
      Size/MD5 checksum:    37102 1de42b75170ef39d77d9bfd2d2c93f16

  Sun Sparc architecture:

      
      Size/MD5 checksum:   741602 9b61a934c926ac5ab90043657909dcec
      
      Size/MD5 checksum:  6579790 514509d90e66037d93549877676d99d4
      
      Size/MD5 checksum:   117708 222910767eec7164764adf2856a90bf4
      
      Size/MD5 checksum:   184168 4e8e05b489008521946733c36d04609d
      
      Size/MD5 checksum:   664932 97915d1d4130f1c44e46bc3efca40c35
      
      Size/MD5 checksum:   668836 365123943821fc1d37f45cfe8e2d30d2
      
      Size/MD5 checksum:   151726 fc9c49b87ddf7febf3a7d6590b6a6291
      
      Size/MD5 checksum:   128616 a79698355c109b2b57bcfb38f2198826
      
      Size/MD5 checksum:   131324 1af4d019b27ee38bb14d131a8cae6681
      
      Size/MD5 checksum:    37104 7d5b21e1c2b4299a915e1044eb93ef21

  These files will probably be moved into the stable distribution on
  its next revision.

---------------------------------------------------------------------------------
For apt-get: deb  Debian -- Security Information  stable/updates main
For dpkg-ftp:    dists/stable/updates/main
Mailing list: debian-security-announce@lists.debian.org
Package info: `apt-cache show ' and  http://packages.debian.org/

Debian: kdelibs Multiple remote vulnerabilities

August 1, 2003
Potential unauthorized access and man-in-the-middle attacks have been fixed.

Summary

Two vulnerabilities were discovered in kdelibs:

- CAN-2003-0459: KDE Konqueror for KDE 3.1.2 and earlier does not
remove authentication credentials from URLs of the
"user:password@host" form in the HTTP-Referer header, which could
allow remote web sites to steal the credentials for pages that link
to the sites.

- CAN-2003-0370: Konqueror Embedded and KDE 2.2.2 and earlier does not
validate the Common Name (CN) field for X.509 Certificates, which
could allow remote attackers to spoof certificates via a
man-in-the-middle attack.

These vulnerabilities are described in the following security
advisories from KDE:

https://kde.org/info/security/advisory-20030729-1.txt
https://kde.org/info/security/advisory-20030602-1.txt

For the current stable distribution (woody) these problems have been
fixed in version 2.2.2-13.woody.8.

For the unstable distribution (sid) these problems have been fixed in
version 4:3.1.3-1.

We recommend that you update your kdelibs package.

Upgrade Instructions
------------...

Read the Full Advisory

Severity
Package : kdelibs

Related News

The End of the Road for Linux 6.11: A Call to Upgrade to Kernel 6.12
3 - 5 min read
The Linux kernel community recently issued an EOL announcement regarding the 6.11 kernel series, urging sysadmins to upgrade quickly to 6.12 . This
A Linux Admin
3 - 6 min read
As 2025 approaches, we Linux admins are facing new and often unseen cloud-native security obstacles. While skilled at mitigating known risks,
Leveraging Insights from the Linux Foundation
3 - 5 min read
The Linux Foundation's recent Census III report provides critical insights for Linux administrators, information security professionals, and anyone
Chrome 131 Released: Emergency Security Update Fixes Over a Dozen Significant Vulns
3 - 6 min read
Google recently unveiled a critical security update to their popular web browser, Google Chrome, addressing over a dozen significant security
From Wayland Fixes to Security Boosts: Examining Qt 6.8.1
3 - 6 min read
The recent Qt 6.8.1 release brings significant updates and improvements, strengthening its reputation as a secure and reliable application
Exploring Arch Linux 2024.12.01: Security Implications & Notable Enhancements for Linux Admins
3 - 6 min read
The Arch Linux 2024.12.01 ISO release marks an impressive milestone, offering cutting-edge updates that enhance functionality, streamline
Deck the Halls with Enhanced Security: Linux Kernel 6.13
3 - 5 min read
As Linux admins and infosec professionals prepare for the holiday season, there's much cause for celebration this year! Linus Torvalds recently made
Lessons from Bootkitty: Securing Linux Systems Against UEFI Intrusions
3 - 5 min read
New Linux security threats mark critical junctures that challenge existing policies and test security protocols to their limit. One such milestone

Get the Latest News & Insights

Sign up to get the latest security news affecting Linux and open source delivered straight to your inbox.

© 2024 Guardian Digital, Inc All Rights Reserved