KDE Konqueror HTTP REFERER Authentication Credential Leak Vulnerability

BID:8297

Info

KDE Konqueror HTTP REFERER Authentication Credential Leak Vulnerability

Bugtraq ID: 8297
Class: Design Error
CVE: CVE-2003-0459
Remote: Yes
Local: No
Published: Jul 29 2003 12:00AM
Updated: Jul 11 2009 10:56PM
Credit: Discovery credited to George Staikos.
Vulnerable: Sun Linux 5.0.7
Redhat kdelibs-sound-devel-2.2-11.ia64.rpm
+ Redhat Linux 7.2 i386
 Redhat kdelibs-sound-devel-2.2-11.i386.rpm
+ Redhat Linux 7.2 i386
 Redhat kdelibs-sound-devel-2.1.1-5.i386.rpm
+ Redhat Linux 7.1
Redhat kdelibs-sound-2.2-11.ia64.rpm
+ Redhat Linux 7.2 i386
 Redhat kdelibs-sound-2.2-11.i386.rpm
+ Redhat Linux 7.2 i386
 Redhat kdelibs-sound-2.1.1-5.i386.rpm
+ Redhat Linux 7.1
Redhat kdelibs-devel-3.1-10.i386.rpm
+ Redhat Linux 9.0 i386
 Redhat kdelibs-devel-3.0.3-8.i386.rpm
+ Redhat Linux 8.0 i386
 Redhat kdelibs-devel-3.0.0-10.i386.rpm
+ Redhat Linux 7.3 i386
 Redhat kdelibs-devel-2.2-11.ia64.rpm
+ Redhat Linux 7.2 ia64
 Redhat kdelibs-devel-2.2-11.i386.rpm
+ Redhat Linux 7.2 i386
 Redhat kdelibs-devel-2.1.1-5.i386.rpm
+ Redhat Linux 7.1
Redhat kdelibs-3.1-10.i386.rpm
+ Redhat Linux 9.0 i386
 Redhat kdelibs-3.0.3-8.i386.rpm
+ Redhat Linux 8.0 i386
 Redhat kdelibs-3.0.0-10.i386.rpm
+ Redhat Linux 7.3 i386
 Redhat kdelibs-2.2-11.ia64.rpm
+ Redhat Linux 7.2 i386
 Redhat kdelibs-2.2-11.i386.rpm
+ Redhat Linux 7.2 i386
 Redhat kdelibs-2.1.1-5.i386.rpm
+ Redhat Linux 7.1
Redhat kdebase-devel-3.0.3-13.i386.rpm
+ Redhat Linux 8.0 i386
 Redhat kdebase-3.0.3-13.i386.rpm
+ Redhat Linux 8.0 i386
 Redhat arts-2.2-11.ia64.rpm
+ Redhat Linux 7.2 i386
 Redhat arts-2.2-11.i386.rpm
+ Redhat Linux 7.2 i386
 RedHat arts-2.1.1-5.i386.rpm delete
Redhat arts-2.1.1-5.i386.rpm
+ Redhat Linux 7.1
KDE Konqueror Embedded 0.1
KDE Konqueror 3.1.2
+ KDE KDE 3.1.2
KDE Konqueror 3.1.1
+ KDE KDE 3.1.1
KDE Konqueror 3.1
+ Mandriva Linux Mandrake 9.1 ppc
 + Mandriva Linux Mandrake 9.1
+ Mandriva Linux Mandrake 9.1
KDE Konqueror 3.0.5
+ MandrakeSoft Corporate Server 2.1
+ Mandriva Linux Mandrake 9.0
+ Mandriva Linux Mandrake 9.0
KDE Konqueror 3.0.3
+ KDE KDE 3.0.3
KDE Konqueror 3.0.2
+ KDE KDE 3.0.2
KDE Konqueror 3.0.1
+ KDE KDE 3.0.1
KDE Konqueror 3.0
+ KDE KDE 3.0
KDE Konqueror 2.2.2
+ Debian Linux 3.0 sparc
 + Debian Linux 3.0 s/390
 + Debian Linux 3.0 ppc
 + Debian Linux 3.0 mipsel
 + Debian Linux 3.0 mips
 + Debian Linux 3.0 m68k
 + Debian Linux 3.0 ia-64
 + Debian Linux 3.0 ia-32
 + Debian Linux 3.0 hppa
 + Debian Linux 3.0 arm
 + Debian Linux 3.0 alpha
 + Debian Linux 3.0
+ Redhat Enterprise Linux AS 2.1 IA64
 + Redhat Enterprise Linux AS 2.1
 + Redhat Enterprise Linux ES 2.1 IA64
 + Redhat Enterprise Linux ES 2.1
 + Redhat Enterprise Linux WS 2.1 IA64
 + Redhat Enterprise Linux WS 2.1
 + Redhat Linux Advanced Work Station 2.1
+ Turbolinux Turbolinux Server 8.0
+ Turbolinux Turbolinux Server 7.0
+ Turbolinux Turbolinux Workstation 8.0
+ Turbolinux Turbolinux Workstation 7.0
KDE Konqueror 2.2.1
KDE Konqueror 2.1.2
KDE Konqueror 2.1.1
Not Vulnerable:

Exploit / POC

KDE Konqueror HTTP REFERER Authentication Credential Leak Vulnerability

No exploit is required for this vulnerability.

Solution / Fix

KDE Konqueror HTTP REFERER Authentication Credential Leak Vulnerability

Solution:
Conectiva have released an advisory (CLSA-2003:770) and fixes to address this issue. See referenced advisory for further detail regarding the application of these fixes. Fixes are linked below.

Sun have released fixes to address this vulnerability in Sun Linux 5.0.7. Users who are affected by this issue are advised to apply relevant fixes as soon as possible. Please see Sun reference (Sun Linux Support - Sun Linux Patches (Sun)) for further details regarding obtaining and applying appropriate fixes.

KDE has made fixes available. See referenced advisory for additional details.

Red Hat Linux has released an advisory (RHSA-2003:235-01) that addresses this issue. Please see the referenced advisory for details on obtaining and applying fixes.

Debian has issued an updated advisory (DSA 361-2). See Debian advisory in the references section for information regarding obtaining and applying fixes.

Mandrake Linux advisory (MDKSA-2003:079) and fixes are available to address this issue. See referenced advisory for further details on obtaining and applying fixes.

TurboLinux has released fixes for this issue. Affected users are advised to run the turbopkg tool to update vulnerable systems.

Red Hat has made updates available for Red Hat Linux Enterprise distributions. These updates are detailed in RHSA-2003:236-08 and may be obtained via the Red Hat Network.

Debian has issued fixes. See Debian advisory DSA-361-1 in the references section for download information.

Slackware has issued fixes. See Slackware advisory (SSA:2003-213-01) in the references section for download information.

Conectiva has released an advisory CLA-2003:747, including fixes to address this and other issues.


Redhat arts-2.2-11.i386.rpm

Redhat kdelibs-2.2-11.ia64.rpm

Redhat kdelibs-sound-devel-2.2-11.ia64.rpm

Redhat arts-2.2-11.ia64.rpm

Redhat kdelibs-sound-2.2-11.i386.rpm

Redhat kdelibs-devel-3.0.0-10.i386.rpm

Redhat kdelibs-sound-devel-2.1.1-5.i386.rpm

Redhat kdelibs-sound-devel-2.2-11.i386.rpm

Redhat kdelibs-devel-2.1.1-5.i386.rpm

Redhat kdelibs-devel-2.2-11.i386.rpm

Redhat kdelibs-3.0.3-8.i386.rpm

Redhat kdelibs-2.1.1-5.i386.rpm

Redhat kdelibs-sound-2.2-11.ia64.rpm

Redhat kdelibs-devel-3.1-10.i386.rpm

Redhat kdelibs-3.0.0-10.i386.rpm

Redhat kdelibs-3.1-10.i386.rpm

Redhat kdelibs-2.2-11.i386.rpm

Redhat kdelibs-sound-2.1.1-5.i386.rpm

Redhat kdebase-3.0.3-13.i386.rpm

Redhat kdelibs-devel-3.0.3-8.i386.rpm

Redhat arts-2.1.1-5.i386.rpm

Redhat kdelibs-devel-2.2-11.ia64.rpm

Redhat kdebase-devel-3.0.3-13.i386.rpm

KDE Konqueror 2.1.2

KDE Konqueror 2.2.1

KDE Konqueror 2.2.2

KDE Konqueror 3.0.5

KDE Konqueror 3.1

KDE Konqueror 3.1.2

Sun Linux 5.0.7

© CVE.report 2026

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report