PT-2007-7422 · Kde · Kde Konqueror

Nils Toedtmann · Published 2007-12-28 · Updated 2018-10-15 · CVE-2007-6591

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions KDE Konqueror versions 3.5.5 through 3.95.00

Description The issue allows remote attackers to trick a user into accepting an invalid certificate for a spoofed web site. This occurs when a user accepts an SSL server certificate based on the CN domain name in the DN field, and the certificate is then regarded as accepted for all domain names in subjectAltName:dNSName fields, even though these fields cannot be examined in the product.

Recommendations For KDE Konqueror versions 3.5.5 through 3.95.00, consider disabling the automatic acceptance of SSL server certificates based on the CN domain name in the DN field until a patch is available. Restrict access to sensitive web sites to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2007-6591

Affected Products

Kde Konqueror

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2007-6591 · Security Note
• http://securityfocus.com/archive/1/483937/100/100/threaded · Note
• http://nils.toedtmann.net/pub/subjectAltName.txt · Note
• http://securityfocus.com/archive/1/483960/100/100/threaded · Note
• http://securityfocus.com/archive/1/483929/100/100/threaded · Note
• http://securityreason.com/securityalert/3498 · Note