[UCI-Linux] Dirk Mueller: KDE Security Advisory: Secure Cookie Vulnerability
Mike IGLESIAS
IGLESIAS@uci.edu
Wed, 11 Sep 2002 08:44:14 -0700
FYI, for those of you using KDE
------- Forwarded Message
Received: from outgoing.securityfocus.com (outgoing2.securityfocus.com [66.38.151.26])
by draco.acs.uci.edu (8.11.6/8.11.6) with ESMTP id g8BFWGd24638
for <iglesias@draco.acs.uci.edu>; Wed, 11 Sep 2002 08:32:16 -0700
Received: from lists.securityfocus.com (lists.securityfocus.com [66.38.151.19])
by outgoing.securityfocus.com (Postfix) with QMQP
id 6BCDE8F2D3; Wed, 11 Sep 2002 08:21:31 -0600 (MDT)
Mailing-List: contact bugtraq-help@securityfocus.com; run by ezmlm
Precedence: bulk
List-Id: <bugtraq.list-id.securityfocus.com>
List-Post: <mailto:bugtraq@securityfocus.com>
List-Help: <mailto:bugtraq-help@securityfocus.com>
List-Unsubscribe: <mailto:bugtraq-unsubscribe@securityfocus.com>
List-Subscribe: <mailto:bugtraq-subscribe@securityfocus.com>
Delivered-To: mailing list bugtraq@securityfocus.com
Delivered-To: moderator for bugtraq@securityfocus.com
Received: (qmail 31035 invoked from network); 10 Sep 2002 22:53:59 -0000
Date: Wed, 11 Sep 2002 01:11:03 +0200
From: Dirk Mueller <mueller@kde.org>
To: kde-announce@kde.org, bugtraq@securityfocus.com
Subject: KDE Security Advisory: Secure Cookie Vulnerability
Message-ID: <20020910231103.GA9492@matrix.wg>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
User-Agent: Mutt/1.3.27i
X-Spam-Status: No, hits=-8.0 required=5.0
tests=DOUBLE_CAPSWORD,PGP_SIGNATURE,USER_IN_WHITELIST_TO
version=2.31
X-Spam-Level:
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
KDE Security Advisory: Secure Cookie Vulnerability
Original Release Date: 2002-09-08
URL: http://www.kde.org/info/security/advisory-20020908-1.txt
0. References
None.
1. Systems affected:
Konqueror in KDE 3.0, KDE 3.0.1 and KDE 3.0.2.
KDE 2.2.2 and KDE 3.0.3 are NOT affected.
2. Overview:
Konqueror fails to detect the "secure" flag in HTTP cookies and as
a result may send secure cookies back to the originating site over
an unencrypted network connection.
3. Impact:
A secure session that relies solely on secure cookies for
identifying the session can possibly be hijacked, or an account
which relies solely on secure cookies for logging on may be
compromised, by an attacker who manages to eavesdrop on the
unencrypted network connection.
4. Solution:
Upgrade to KDE 3.0.3 in which this problem is fixed or apply the
patch below.
5. Patch:
A patch for KDE 3.0, KDE 3.0.1 and KDE 3.0.2 is available from
ftp://ftp.kde.org/pub/kde/security_patches :
1abff4a02381b5ca11273d02c6a5c6ca post-3.0-kdelibs-kcookiejar.diff
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.7 (GNU/Linux)
iD8DBQE9fldFvsXr+iuy1UoRAkfxAJ9tqM141Dx+7b8ZHlxUcU6uJIsJ0QCg5kXu
PFXLjBmWgER6vfvpYcOiLYM=
=UT1J
- -----END PGP SIGNATURE-----
------- End of Forwarded Message