ID

VAR-200209-0010

CVE

CVE-2002-0970

TITLE

KDE of Konqueror Vulnerability in Forged Trusted Site Certificate Vulnerability

DESCRIPTION

The SSL capability for Konqueror in KDE 3.0.2 and earlier does not verify the Basic Constraints for an intermediate CA-signed certificate, which allows remote attackers to spoof the certificates of trusted sites via a man-in-the-middle attack. ------------ This vulnerability information is a summary of multiple vulnerabilities released at the same time. Please note that the contents of vulnerability information other than the title are included. ------------ * KDE Is X Window System It is a comprehensive desktop environment developed for use. * Red Hat Linux Implemented in KDE 2.x , 3.x Has several security issues: 1. KDE 3.0.2 Included with Web browser Konqueror of SSL There is a problem that the site that is not functional and treats an untrusted site as a trusted site. 2. KDE 3.0 From 3.0.2 of Konqueror In Cookie of secure There is a flaw that does not detect the flag, Cookie There is a problem that leaks. 3. KDE 3.0.3 previous Konqueror Has a problem with cross-site scripting attacks. 4. KDE 3.0.1 Implemented from kpf There is a problem with a file that allows a local attacker to view an arbitrary file. 5. KDE 2.x From 3.0.4 In rlogin Protocol and telnet There is a flaw in the implementation of the protocol that can be exploited by remote and local attackers KDE There is a problem that arbitrary code is executed with the execution right. 6. KDE LAN Provide browsing function resLISa There is a buffer overflow problem, LISa Has a privilege escalation problem. (LISa The service is disabled by default )Please refer to the “Overview” for the impact of this vulnerability. A flaw has been reported in the handling of X.509 certificates by a number of products, including several web browsers. It may be possible for a malicious party to create certificates for arbitrary domains, which will be treated as trusted by the vulnerable browser. The flaw lies in the handling of intermediate certificate authorities. Normally, intermediate certificates should possess a Basic Constraints field which states the certificate may be used as a signing authority. Vulnerable products do not require the Basic Constraints field be properly defined. A malicious party with one valid certificate may sign a new certificate for an arbitrary domain. This may allow the attacker to spoof a sensitive domain, or to attempt a man-in-the-middle attack against encrypted communications. This vulnerability was originally reported in Microsoft's Internet Explorer web browser. It has been reported that, in the case of Microsoft Internet Explorer, the flaw lies in some cryptographic functions implemented in the operating system. It should be noted that this flaw has not been reported in the Cryptographic API included with Microsoft Windows. Reports state that IIS 5.0 under Windows 2000 is also vulnerable. In this case, client certificate chains are not properly verified. Attackers may exploit this vulnerability to bypass some authentication schemes. Versions 3.0.2 and earlier are vulnerable. ** A report suggests that the patch issued by Microsoft may not fully protect against this vulnerability. It may be possible that a malicious site using an invalid certificate may mislead users into believing that a certificate is expired rather than being invalid. ** UPDATE 11/11/03 - Microsoft has updated their bulletin for this issue. Users who installed Internet Explorer 6 after installing Windows 2000 Service Pack 4 may have reintroduced this issue onto their systems. A new patch is available for users who installed Internet Explorer 6 on Windows 2000 SP4 systems

AFFECTED PRODUCTS

CVSS

PROBLEMTYPE DATA

THREAT TYPE

remote

TYPE

unknown

CONFIGURATIONS

PATCH

EXTERNAL IDS

REFERENCES

CREDITS

Reported by Mike Benham <moxie@thoughtcrime.org>.

SOURCES

LAST UPDATE DATE

2024-11-22T22:54:15.922000+00:00

SOURCES UPDATE DATE

SOURCES RELEASE DATE