PT-2002-1061 · Kde · Kdelibs+5
Jesse Burns
·
Publicado
2002-11-27
·
Atualizado
2008-09-10
·
CVE-2003-0370
CVSS v2.0
7.5
Alta
| Vetor | AV:N/AC:L/Au:N/C:P/I:P/A:P |
Name of the Vulnerable Software and Affected Versions
KDE versions 2.2.2 and earlier
kdelibs versions 2.2.2 and earlier
kdelibs-devel versions 2.2.2 and earlier
kdelibs-sound versions 2.2.2 and earlier
kdelibs-sound-devel versions 2.2.2 and earlier
Description
The issue concerns multiple vulnerabilities in KDE and related packages, which can lead to breaches of confidentiality, integrity, and availability of protected information. These vulnerabilities can be exploited remotely. Specifically, Konqueror Embedded and KDE do not validate the Common Name (CN) field for X.509 Certificates, allowing remote attackers to spoof certificates via a man-in-the-middle attack.
Recommendations
For KDE versions 2.2.2 and earlier, consider updating to a newer version to mitigate the risk.
For kdelibs versions 2.2.2 and earlier, consider updating to a newer version to mitigate the risk.
For kdelibs-devel versions 2.2.2 and earlier, consider updating to a newer version to mitigate the risk.
For kdelibs-sound versions 2.2.2 and earlier, consider updating to a newer version to mitigate the risk.
For kdelibs-sound-devel versions 2.2.2 and earlier, consider updating to a newer version to mitigate the risk.
As a temporary workaround, consider restricting access to sensitive information and implementing additional security measures to minimize the risk of exploitation.
Correção
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Kde
Konqueror Embedded
Kdelibs
Kdelibs-Devel
Kdelibs-Sound
Kdelibs-Sound-Devel