PT-2017-17048 · Kde+1 · Kde Kio+2

Published 2017-03-02 · Updated 2019-10-03 · CVE-2017-6410

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions KDE kio versions prior to 5.32 kdelibs versions prior to 4.14.30

Description The issue allows remote attackers to obtain sensitive information via a crafted PAC file. This is due to the kpac/script.cpp in KDE kio and kdelibs calling the PAC FindProxyForURL function with a full https URL, potentially including Basic Authentication credentials, a query string, or PATH INFO.

Recommendations For KDE kio versions prior to 5.32, update to version 5.32 or later. For kdelibs versions prior to 4.14.30, update to version 4.14.30 or later.

Fix

Cleartext Transmission of Sensitive Information

Weakness Enumeration

CWE-319

Related Identifiers

CVE-2017-6410

DLA-952-1

DSA-3849-1

MGASA-2017-0079

OPENSUSE-SU-2017:0677-1

OPENSUSE-SU-2017:0680-1

USN-3223-1

Affected Products

Kde Kio

Ubuntu

Kdelibs

References · 25

• https://osv.dev/vulnerability/USN-3223-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/source-package/kde4libs · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-6410 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2017-6410 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2017:0680-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/DSA-3849-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2017-6410 · Vendor Advisory
• https://kde.org/info/security/advisory-20170228-1.txt · Vendor Advisory
• https://osv.dev/vulnerability/DSA-3849-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-6410 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2017-0079 · Vendor Advisory
• http://debian.org/security/2017/dsa-3849 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2017:0677-1 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-8422 · Security Note
• https://ubuntu.com/security/CVE-2017-6410 · Vendor Advisory