CVE-2004-1145
Summary
| CVE | CVE-2004-1145 |
|---|---|
| State | PUBLISHED |
| Assigner | mitre |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2004-12-15 05:00:00 UTC |
| Updated | 2025-04-03 01:03:51 UTC |
| Description | Multiple vulnerabilities in Konqueror in KDE 3.3.1 and earlier (1) allow access to restricted Java classes via JavaScript and (2) do not properly restrict access to certain Java classes from the Java applet, which allows remote attackers to bypass sandbox restrictions and read or write arbitrary files. |
Risk And Classification
Primary CVSS: v2.0 5 from [email protected]
AV:N/AC:L/Au:N/C:N/I:P/A:N
Problem Types: NVD-CWE-Other | n/a
CVSS v2.0 Breakdown
Access Vector
NetworkAccess Complexity
LowAuthentication
NoneConfidentiality
NoneIntegrity
PartialAvailability
NoneAV:N/AC:L/Au:N/C:N/I:P/A:N
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Operating System | Altlinux | Alt Linux | 2.3 | All | compact | All |
| Operating System | Altlinux | Alt Linux | 2.3 | All | junior | All |
| Operating System | Conectiva | Linux | 10.0 | All | All | All |
| Operating System | Conectiva | Linux | 9.0 | All | All | All |
| Operating System | Debian | Debian Linux | 3.0 | All | alpha | All |
| Operating System | Debian | Debian Linux | 3.0 | All | arm | All |
| Operating System | Debian | Debian Linux | 3.0 | All | hppa | All |
| Operating System | Debian | Debian Linux | 3.0 | All | ia-32 | All |
| Operating System | Debian | Debian Linux | 3.0 | All | ia-64 | All |
| Operating System | Debian | Debian Linux | 3.0 | All | m68k | All |
| Operating System | Debian | Debian Linux | 3.0 | All | mips | All |
| Operating System | Debian | Debian Linux | 3.0 | All | mipsel | All |
| Operating System | Debian | Debian Linux | 3.0 | All | ppc | All |
| Operating System | Debian | Debian Linux | 3.0 | All | s-390 | All |
| Operating System | Debian | Debian Linux | 3.0 | All | sparc | All |
| Application | Ethereal Group | Ethereal | 0.10 | All | All | All |
| Application | Ethereal Group | Ethereal | 0.10.1 | All | All | All |
| Application | Ethereal Group | Ethereal | 0.10.2 | All | All | All |
| Application | Ethereal Group | Ethereal | 0.10.3 | All | All | All |
| Application | Ethereal Group | Ethereal | 0.10.4 | All | All | All |
| Application | Ethereal Group | Ethereal | 0.10.5 | All | All | All |
| Application | Ethereal Group | Ethereal | 0.10.6 | All | All | All |
| Application | Ethereal Group | Ethereal | 0.10.7 | All | All | All |
| Application | Ethereal Group | Ethereal | 0.9 | All | All | All |
| Application | Ethereal Group | Ethereal | 0.9.1 | All | All | All |
| Application | Ethereal Group | Ethereal | 0.9.10 | All | All | All |
| Application | Ethereal Group | Ethereal | 0.9.11 | All | All | All |
| Application | Ethereal Group | Ethereal | 0.9.12 | All | All | All |
| Application | Ethereal Group | Ethereal | 0.9.13 | All | All | All |
| Application | Ethereal Group | Ethereal | 0.9.14 | All | All | All |
| Application | Ethereal Group | Ethereal | 0.9.15 | All | All | All |
| Application | Ethereal Group | Ethereal | 0.9.16 | All | All | All |
| Application | Ethereal Group | Ethereal | 0.9.2 | All | All | All |
| Application | Ethereal Group | Ethereal | 0.9.3 | All | All | All |
| Application | Ethereal Group | Ethereal | 0.9.4 | All | All | All |
| Application | Ethereal Group | Ethereal | 0.9.5 | All | All | All |
| Application | Ethereal Group | Ethereal | 0.9.6 | All | All | All |
| Application | Ethereal Group | Ethereal | 0.9.7 | All | All | All |
| Application | Ethereal Group | Ethereal | 0.9.8 | All | All | All |
| Application | Ethereal Group | Ethereal | 0.9.9 | All | All | All |
| Operating System | Redhat | Enterprise Linux | 2.1 | All | advanced_server | All |
| Operating System | Redhat | Enterprise Linux | 2.1 | All | advanced_server_ia64 | All |
| Operating System | Redhat | Enterprise Linux | 2.1 | All | enterprise_server | All |
| Operating System | Redhat | Enterprise Linux | 2.1 | All | enterprise_server_ia64 | All |
| Operating System | Redhat | Enterprise Linux | 2.1 | All | workstation | All |
| Operating System | Redhat | Enterprise Linux | 2.1 | All | workstation_ia64 | All |
| Operating System | Redhat | Enterprise Linux | 3.0 | All | advanced_server | All |
| Operating System | Redhat | Enterprise Linux | 3.0 | All | enterprise_server | All |
| Operating System | Redhat | Enterprise Linux | 3.0 | All | workstation_server | All |
| Operating System | Redhat | Enterprise Linux Desktop | 3.0 | All | All | All |
| Operating System | Redhat | Linux Advanced Workstation | 2.1 | All | ia64 | All |
| Operating System | Redhat | Linux Advanced Workstation | 2.1 | All | itanium_processor | All |
| Application | Sgi | Propack | 3.0 | All | All | All |
| Operating System | Suse | Suse Linux | 8.0 | All | All | All |
| Operating System | Suse | Suse Linux | 8.0 | All | i386 | All |
| Operating System | Suse | Suse Linux | 8.1 | All | All | All |
| Operating System | Suse | Suse Linux | 8.2 | All | All | All |
| Operating System | Suse | Suse Linux | 9.0 | All | All | All |
| Operating System | Suse | Suse Linux | 9.0 | All | x86_64 | All |
| Operating System | Suse | Suse Linux | 9.1 | All | All | All |
| Operating System | Suse | Suse Linux | 9.2 | All | All | All |
Vendor Declared Affected Products
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| Advisories - Mandriva | af854a3a-2127-422b-91ae-364da2661108 | www.mandriva.com | |
| US-CERT Vulnerability Note VU#420222 | af854a3a-2127-422b-91ae-364da2661108 | www.kb.cert.org | Patch, Third Party Advisory, US Government Resource |
| Support | af854a3a-2127-422b-91ae-364da2661108 | www.redhat.com | Patch, Vendor Advisory |
| 'KDE Security Advisory: Konqueror Java Vulnerability' - MARC | af854a3a-2127-422b-91ae-364da2661108 | marc.info | |
| Secunia - Advisories - KDE Konqueror Java Sandbox Security Bypass Vulnerabilities | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | Patch, Vendor Advisory |
| Gentoo Linux Documentation -- Konqueror: Java sandbox vulnerabilities | af854a3a-2127-422b-91ae-364da2661108 | www.gentoo.org | Patch, Vendor Advisory |
| heise Security - c't-Browsercheck | af854a3a-2127-422b-91ae-364da2661108 | www.heise.de | Vendor Advisory |
| IBM X-Force Exchange | af854a3a-2127-422b-91ae-364da2661108 | exchange.xforce.ibmcloud.com | |
| www.kde.org/info/security/advisory-20041220-1.txt | af854a3a-2127-422b-91ae-364da2661108 | www.kde.org | Patch, Vendor Advisory |
| Repository / Oval Repository | af854a3a-2127-422b-91ae-364da2661108 | oval.cisecurity.org | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.