CVE-2004-0746

Description

Konqueror in KDE 3.2.3 and earlier allows web sites to set cookies for country-specific top-level domains, such as .ltd.uk, .plc.uk and .firm.in, which could allow remote attackers to perform a session fixation attack and hijack a user's HTTP session.

Affected products

• gentoo / linux1.4 – 1.4
• KDE / kde3.1.3 – 3.1.3
• KDE / kde3.2 – 3.2
• KDE / Konqueror3.0.3 – 3.0.3
• KDE / Konqueror3.0.5 – 3.0.5
• KDE / Konqueror3.0.5b – 3.0.5b
• KDE / Konqueror3.1 – 3.1
• KDE / Konqueror3.1.1 – 3.1.1
• KDE / Konqueror3.1.2 – 3.1.2
• KDE / Konqueror3.1.3 – 3.1.3
• KDE / Konqueror3.1.5 – 3.1.5
• KDE / Konqueror3.2.1 – 3.2.1
• KDE / Konqueror3.2.3 – 3.2.3
• KDE / Konqueror3.0 – 3.0
• KDE / Konqueror3.0.1 – 3.0.1
• KDE / Konqueror3.0.2 – 3.0.2
• mandrakesoft / mandrake_linux9.2 – 9.2
• mandrakesoft / mandrake_linux9.2 – 9.2
• mandrakesoft / mandrake_linux10.0 – 10.0
• mandrakesoft / mandrake_linux10.0 – 10.0
• SUSE / suse_linux8 – 8
• SUSE / suse_linux8.1 – 8.1
• SUSE / suse_linux8.2 – 8.2
• SUSE / suse_linux9.0 – 9.0
• SUSE / suse_linux9.0 – 9.0
• SUSE / suse_linux9.0 – 9.0
• SUSE / suse_linux9.1 – 9.1

References

• VENDOR_ADVISORYhttp://secunia.com/advisories/12341
• MISChttps://exchange.xforce.ibmcloud.com/vulnerabilities/17063
• MISChttp://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000864
• VENDOR_ADVISORYhttp://www.mandrakesecure.net/en/advisories/advisory.php?name=MDKSA-2004:086
• MISChttp://www.securityfocus.com/bid/10991
• MISChttp://www.kde.org/info/security/advisory-20040823-1.txt
• MISChttps://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11281
• MAILING_LISThttp://marc.info/?l=bugtraq&m=109327681304401&w=2