KDE Konqueror/IOSlave FTP PASV Port-Scanning Vulnerability

Bugtraq ID:	23091
Class:	Design Error
CVE:	CVE-2007-1564
Remote:	Yes
Local:	No
Published:	Mar 21 2007 12:00AM
Updated:	Mar 19 2015 09:35AM
Credit:	[email protected] is credited with the discovery of this vulnerability.
Vulnerable:	Ubuntu Ubuntu Linux 5.10 sparc Ubuntu Ubuntu Linux 5.10 powerpc Ubuntu Ubuntu Linux 5.10 i386 Ubuntu Ubuntu Linux 5.10 amd64 Ubuntu Ubuntu Linux 6.10 sparc Ubuntu Ubuntu Linux 6.10 powerpc Ubuntu Ubuntu Linux 6.10 i386 Ubuntu Ubuntu Linux 6.10 amd64 Ubuntu Ubuntu Linux 6.06 LTS sparc Ubuntu Ubuntu Linux 6.06 LTS powerpc Ubuntu Ubuntu Linux 6.06 LTS i386 Ubuntu Ubuntu Linux 6.06 LTS amd64 SuSE SUSE Linux Enterprise Server SDK 9 SuSE SUSE Linux Enterprise Server 9 SP3 SuSE SUSE Linux Enterprise Server 9 SuSE SUSE Linux Enterprise Server 10 SuSE SUSE Linux Enterprise SDK 9 SuSE SUSE Linux Enterprise SDK 10 SuSE SUSE Linux Enterprise Desktop 10 SuSE Linux Professional 10.2 x86_64 SuSE Linux Personal 10.2 x86_64 S.u.S.E. UnitedLinux 1.0 S.u.S.E. SuSE Linux Standard Server 8.0 S.u.S.E. SuSE Linux School Server for i386 S.u.S.E. SUSE LINUX Retail Solution 8.0 S.u.S.E. SuSE Linux Openexchange Server 4.0 S.u.S.E. SuSE Linux Open-Xchange 4.1 S.u.S.E. SUSE CORE 9 for x86 S.u.S.E. openSUSE 10.2 S.u.S.E. Open-Enterprise-Server 9.0 S.u.S.E. Open-Enterprise-Server 1 S.u.S.E. Open-Enterprise-Server 0 S.u.S.E. Office Server S.u.S.E. Novell Linux POS 9 S.u.S.E. Novell Linux Desktop 9.0 S.u.S.E. Novell Linux Desktop 1.0 S.u.S.E. Linux Professional 10.0 OSS S.u.S.E. Linux Professional 10.0 S.u.S.E. Linux Professional 10.2 S.u.S.E. Linux Professional 10.1 S.u.S.E. Linux Personal 10.0 OSS S.u.S.E. Linux Personal 10.2 S.u.S.E. Linux Personal 10.1 S.u.S.E. Linux Openexchange Server S.u.S.E. Linux Office Server S.u.S.E. Linux Enterprise Server for S/390 9.0 S.u.S.E. Linux Enterprise Server for S/390 S.u.S.E. Linux Desktop 1.0 S.u.S.E. Linux Desktop 10 S.u.S.E. Linux Database Server 0 S.u.S.E. Linux Connectivity Server S.u.S.E. Linux 10.1 x86-64 S.u.S.E. Linux 10.1 x86 S.u.S.E. Linux 10.1 ppc S.u.S.E. Linux 10.0 x86-64 S.u.S.E. Linux 10.0 x86 S.u.S.E. Linux 10.0 ppc rPath rPath Linux 1 Pardus Linux 2007.1 Mandriva Linux Mandrake 2007.0 x86_64 Mandriva Linux Mandrake 2007.0 MandrakeSoft Corporate Server 4.0 x86_64 MandrakeSoft Corporate Server 3.0 x86_64 MandrakeSoft Corporate Server 3.0 MandrakeSoft Corporate Server 4.0 KDE Konqueror 3.5.5 KDE Konqueror 3.5.2 KDE Konqueror 3.5.1 KDE Konqueror 3.3.2 KDE Konqueror 3.3.1 KDE Konqueror 3.3 KDE Konqueror 3.2.3 KDE Konqueror 3.2.2 -6 KDE Konqueror 3.2.1 KDE Konqueror 3.1.5 KDE Konqueror 3.1.4 KDE Konqueror 3.1.3 KDE Konqueror 3.1.2 + KDE KDE 3.1.2 KDE Konqueror 3.1.1 + KDE KDE 3.1.1 KDE Konqueror 3.1 + Mandriva Linux Mandrake 9.1 ppc + Mandriva Linux Mandrake 9.1 + Mandriva Linux Mandrake 9.1 KDE Konqueror 3.0.5 b KDE Konqueror 3.0.5 KDE Konqueror 3.0.3 + KDE KDE 3.0.3 KDE Konqueror 3.0.2 KDE Konqueror 3.0.1 KDE Konqueror 3.0 + KDE KDE 3.0 KDE KDE 3.5.6 KDE KDE 3.5.5 KDE KDE 3.5.4 KDE KDE 3.5.3 KDE KDE 3.5.2 KDE KDE 3.5.1 KDE KDE 3.5 KDE KDE 3.4.3 KDE KDE 3.4.2 KDE KDE 3.4.1 KDE KDE 3.4 KDE KDE 3.3.2 + Debian Linux 3.1 sparc + Debian Linux 3.1 s/390 + Debian Linux 3.1 s/390 + Debian Linux 3.1 s/390 + Debian Linux 3.1 ppc + Debian Linux 3.1 ppc + Debian Linux 3.1 ppc + Debian Linux 3.1 mipsel + Debian Linux 3.1 mipsel + Debian Linux 3.1 mipsel + Debian Linux 3.1 mips + Debian Linux 3.1 mips + Debian Linux 3.1 mips + Debian Linux 3.1 m68k + Debian Linux 3.1 m68k + Debian Linux 3.1 m68k + Debian Linux 3.1 ia-64 + Debian Linux 3.1 ia-64 + Debian Linux 3.1 ia-64 + Debian Linux 3.1 ia-32 + Debian Linux 3.1 ia-32 + Debian Linux 3.1 ia-32 + Debian Linux 3.1 hppa + Debian Linux 3.1 hppa + Debian Linux 3.1 hppa + Debian Linux 3.1 arm + Debian Linux 3.1 arm + Debian Linux 3.1 arm + Debian Linux 3.1 amd64 + Debian Linux 3.1 amd64 + Debian Linux 3.1 amd64 + Debian Linux 3.1 alpha + Debian Linux 3.1 alpha + Debian Linux 3.1 alpha + Debian Linux 3.1 + Debian Linux 3.1 + Debian Linux 3.1 KDE KDE 3.3.1 + Red Hat Fedora Core3 KDE KDE 3.3 KDE KDE 3.2.3 KDE KDE 3.2.2 KDE KDE 3.2.1 KDE KDE 3.2 KDE KDE 3.1.5 KDE KDE 3.1.4 KDE KDE 3.1.3 KDE KDE 3.1.2 KDE KDE 3.1.1 a KDE KDE 3.1.1 + Conectiva Linux 9.0 + S.u.S.E. Linux Personal 8.2 + S.u.S.E. Linux Personal 8.2 KDE KDE 3.1 KDE KDE 3.0.5 b KDE KDE 3.0.5 a KDE KDE 3.0.5 + Conectiva Linux 8.0 KDE KDE 3.0.4 + Conectiva Linux 8.0 + Gentoo Linux 1.4 _rc1 + Gentoo Linux 1.2 + Gentoo Linux 1.2 KDE KDE 3.0.3 a KDE KDE 3.0.3 + Conectiva Linux 8.0 + Conectiva Linux 8.0 + Conectiva Linux Enterprise Edition 1.0 + FreeBSD FreeBSD 4.7 -STABLE + FreeBSD FreeBSD 4.7 -STABLE + Mandriva Linux Mandrake 9.0 + Mandriva Linux Mandrake 9.0 KDE KDE 3.0.2 + Mandriva Linux Mandrake 8.2 KDE KDE 3.0.1 KDE KDE 3.0 + Conectiva Linux 8.0
Not Vulnerable:

KDE Konqueror/IOSlave FTP PASV Port-Scanning Vulnerability

KDE Konqueror is prone to a vulnerability that may allow attackers to obtain potentially sensitive information.

A successful exploit of this issue would cause the affected application to connect to arbitrary TCP ports and potentially reveal sensitive information about services that are running on the affected computer. Information obtained may aid attackers in further attacks.

KDE Konqueror/IOSlave FTP PASV Port-Scanning Vulnerability

The following exploit code is available:

• /data/vulnerabilities/exploits/ftp-pasv-poc-v1.0.zip

KDE Konqueror/IOSlave FTP PASV Port-Scanning Vulnerability

Solution:
The vendor has released patches to address this issue.


KDE KDE 3.4

• KDE CVE-2007-1564-kdelibs-3.4.3.diff
  ftp://ftp.kde.org/pub/kde/security_patches

KDE KDE 3.5

• KDE CVE-2007-1564-kdelibs-3.5.6.diff
  ftp://ftp.kde.org/pub/kde/security_patches

KDE KDE 3.5.1

• KDE CVE-2007-1564-kdelibs-3.5.6.diff
  ftp://ftp.kde.org/pub/kde/security_patches

KDE KDE 3.5.2

• KDE CVE-2007-1564-kdelibs-3.5.6.diff
  ftp://ftp.kde.org/pub/kde/security_patches

KDE KDE 3.5.3

• KDE CVE-2007-1564-kdelibs-3.5.6.diff
  ftp://ftp.kde.org/pub/kde/security_patches

KDE KDE 3.5.5

• KDE CVE-2007-1564-kdelibs-3.5.6.diff
  ftp://ftp.kde.org/pub/kde/security_patches

KDE KDE 3.5.6

• KDE CVE-2007-1564-kdelibs-3.5.6.diff
  ftp://ftp.kde.org/pub/kde/security_patches

KDE Konqueror/IOSlave FTP PASV Port-Scanning Vulnerability

References:

• Konqueror Homepage (Konqueror)
  
• Manipulating FTP Clients Using The PASV Command ([email protected])
  
• [KDE Security Advisory] KDE ioslave PASV port scanning vulnerability (KDE)
  
• KDE Security Advisory: KDE ioslave PASV port scanning vulnerability (KDE)