PT-2007-7422 · Kde · Kde Konqueror

Nils Toedtmann · Publicado 2007-12-28 · Atualizado 2018-10-15 · CVE-2007-6591

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions KDE Konqueror versions 3.5.5 through 3.95.00

Description The issue allows remote attackers to trick a user into accepting an invalid certificate for a spoofed web site. This occurs when a user accepts an SSL server certificate based on the CN domain name in the DN field, and the certificate is then regarded as accepted for all domain names in subjectAltName:dNSName fields, even though these fields cannot be examined in the product.

Recommendations For KDE Konqueror versions 3.5.5 through 3.95.00, consider disabling the automatic acceptance of SSL server certificates based on the CN domain name in the DN field until a patch is available. Restrict access to sensitive web sites to minimize the risk of exploitation.

Correção

Identificadores relacionados

CVE-2007-6591

Produtos afetados

Kde Konqueror

Referências · 6

• http://securityfocus.com/archive/1/483937/100/100/threaded · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-6591 · Nota de Segurança
• http://nils.toedtmann.net/pub/subjectAltName.txt · Nota
• http://securityfocus.com/archive/1/483960/100/100/threaded · Nota
• http://securityfocus.com/archive/1/483929/100/100/threaded · Nota
• http://securityreason.com/securityalert/3498 · Nota