KDE / Konqueror Embedded Common Name证书验证漏洞

漏洞信息详情

KDE / Konqueror Embedded Common Name证书验证漏洞

• CNNVD编号：CNNVD-200306-100
• 危害等级： 高危
  
  
• CVE编号：
  CVE-2003-0370
  
• 漏洞类型：
  
  
  设计错误
  
• 发布时间：
  
  2003-06-16
  
• 威胁类型：
  
  
  远程
  
• 更新时间：
  
  2005-10-20
  
• 厂        商：
  
  kde
• 漏洞来源：
  Discovery of this …

Konqueror Embedded和KDE 2.2.2及其更早的版本没有验证X.509证书的Common Name (CN)字段，远程攻击者可能利用该漏洞借助一个man-in-the-middle攻击骗取证书。

Please see the referenced advisories for more information.
KDE Konqueror Embedded 0.1

• KDE konqueror-embedded-snapshot-20030516.tar.gz
  
  http://devel-home.kde.org/~hausmann/snapshots/konqueror-embedded-snaps
  hot-20030516.tar.gz

KDE KDE 2.2.2

• Debian kdelibs-dev_2.2.2-13.woody.8_alpha.debDebian GNU/Linux 3.0 (woody)
  
  http://security.debian.org/pool/updates/main/k/kdelibs/kdelibs-dev_2.2
  .2-13.woody.8_alpha.deb
• Debian kdelibs-dev_2.2.2-13.woody.8_arm.debDebian GNU/Linux 3.0 (woody)
  
  http://security.debian.org/pool/updates/main/k/kdelibs/kdelibs-dev_2.2
  .2-13.woody.8_arm.deb
• Debian kdelibs-dev_2.2.2-13.woody.8_hppa.debDebian GNU/Linux 3.0 (woody)
  
  http://security.debian.org/pool/updates/main/k/kdelibs/kdelibs-dev_2.2
  .2-13.woody.8_hppa.deb
• Debian kdelibs-dev_2.2.2-13.woody.8_i386.debDebian GNU/Linux 3.0 (woody)
  
  http://security.debian.org/pool/updates/main/k/kdelibs/kdelibs-dev_2.2
  .2-13.woody.8_i386.deb
• Debian kdelibs-dev_2.2.2-13.woody.8_ia64.debDebian GNU/Linux 3.0 (woody)
  
  http://security.debian.org/pool/updates/main/k/kdelibs/kdelibs-dev_2.2
  .2-13.woody.8_ia64.deb
• Debian kdelibs-dev_2.2.2-13.woody.8_m68k.debDebian GNU/Linux 3.0 (woody)
  
  http://security.debian.org/pool/updates/main/k/kdelibs/kdelibs-dev_2.2
  .2-13.woody.8_m68k.deb
• Debian kdelibs-dev_2.2.2-13.woody.8_mips.debDebian GNU/Linux 3.0 (woody)
  
  http://security.debian.org/pool/updates/main/k/kdelibs/kdelibs-dev_2.2
  .2-13.woody.8_mips.deb
• Debian kdelibs-dev_2.2.2-13.woody.8_mipsel.debDebian GNU/Linux 3.0 (woody)
  
  http://security.debian.org/pool/updates/main/k/kdelibs/kdelibs-dev_2.2
  .2-13.woody.8_mipsel.deb
• Debian kdelibs-dev_2.2.2-13.woody.8_powerpc.debDebian GNU/Linux 3.0 (woody)
  
  http://security.debian.org/pool/updates/main/k/kdelibs/kdelibs-dev_2.2
  .2-13.woody.8_powerpc.deb
• Debian kdelibs-dev_2.2.2-13.woody.8_s390.debDebian GNU/Linux 3.0 (woody)
  
  http://security.debian.org/pool/updates/main/k/kdelibs/kdelibs-dev_2.2
  .2-13.woody.8_s390.deb
• Debian kdelibs-dev_2.2.2-13.woody.8_sparc.debDebian GNU/Linux 3.0 (woody)
  
  http://security.debian.org/pool/updates/main/k/kdelibs/kdelibs-dev_2.2
  .2-13.woody.8_sparc.deb
• Debian kdelibs3-bin_2.2.2-13.woody.8_alpha.debDebian GNU/Linux 3.0 (woody)
  
  http://security.debian.org/pool/updates/main/k/kdelibs/kdelibs3-bin_2.
  2.2-13.woody.8_alpha.deb
• Debian kdelibs3-bin_2.2.2-13.woody.8_hppa.debDebian GNU/Linux 3.0 (woody)
  
  http://security.debian.org/pool/updates/main/k/kdelibs/kdelibs3-bin_2.
  2.2-13.woody.8_hppa.deb
• Debian kdelibs3-bin_2.2.2-13.woody.8_ia64.debDebian GNU/Linux 3.0 (woody)
  
  http://security.debian.org/pool/updates/main/k/kdelibs/kdelibs3-bin_2.
  2.2-13.woody.8_ia64.deb
• Debian kdelibs3-bin_2.2.2-13.woody.8_m68k.debDebian GNU/Linux 3.0 (woody)
  
  http://security.debian.org/pool/updates/main/k/kdelibs/kdelibs3-bin_2.
  2.2-13.woody.8_m68k.deb
• Debian kdelibs3-bin_2.2.2-13.woody.8_mips.debDebian GNU/Linux 3.0 (woody)
  
  http://security.debian.org/pool/updates/main/k/kdelibs/kdelibs3-bin_2.
  2.2-13.woody.8_mips.deb
• Debian kdelibs3-bin_2.2.2-13.woody.8_mipsel.debDebian GNU/Linux 3.0 (woody)
  
  http://security.debian.org/pool/updates/main/k/kdelibs/kdelibs3-bin_2.
  2.2-13.woody.8_mipsel.deb
• Debian kdelibs3-bin_2.2.2-13.woody.8_powerpc.debDebian GNU/Linux 3.0 (woody)
  
  http://security.debian.org/pool/updates/main/k/kdelibs/kdelibs3-bin_2.
  2.2-13.woody.8_powerpc.deb
• Debian kdelibs3-bin_2.2.2-13.woody.8_s390.debDebian GNU/Linux 3.0 (woody)
  
  http://security.debian.org/pool/updates/main/k/kdelibs/kdelibs3-bin_2.
  2.2-13.woody.8_s390.deb
• Debian kdelibs3-bin_2.2.2-13.woody.8_sparc.debDebian GNU/Linux 3.0 (woody)
  
  http://security.debian.org/pool/updates/main/k/kdelibs/kdelibs3-bin_2.
  2.2-13.woody.8_sparc.deb
• Debian kdelibs3-crypto_2.2.2-6woody2_alpha.debDebian GNU/Linux 3.0 (woody)
  
  http://security.debian.org/pool/updates/main/k/kdelibs-crypto/kdelibs3
  -crypto_2.2.2-6woody2_alpha.deb
• Debian kdelibs3-crypto_2.2.2-6woody2_arm.debDebian GNU/Linux 3.0 (woody)
  
  http://security.debian.org/pool/updates/main/k/kdelibs-crypto/kdelibs3
  -crypto_2.2.2-6woody2_arm.deb
• Debian kdelibs3-crypto_2.2.2-6woody2_hppa.debDebian GNU/Linux 3.0 (woody)
  
  http://security.debian.org/pool/updates/main/k/kdelibs-crypto/kdelibs3
  -crypto_2.2.2-6woody2_hppa.deb
• Debian kdelibs3-crypto_2.2.2-6woody2_i386.debDebian GNU/Linux 3.0 (woody)
  
  http://security.debian.org/pool/updates/main/k/kdelibs-crypto/kdelibs3
  -crypto_2.2.2-6woody2_i386.deb
• Debian kdelibs3-crypto_2.2.2-6woody2_ia64.debDebian GNU/Linux 3.0 (woody)

来源: REDHAT
名称: RHSA-2003:192
链接:http://www.redhat.com/support/errata/RHSA-2003-192.html

来源: www.kde.org
链接:http://www.kde.org/info/security/advisory-20030602-1.txt

来源: TURBO
名称: TLSA-2003-36
链接:http://www.turbolinux.com/security/TLSA-2003-36.txt

来源: BUGTRAQ
名称: 20030507 Problem: Multiple Web Browsers do not do not validate CN on certificates.
链接:http://www.securityfocus.com/archive/1/320707

来源: REDHAT
名称: RHSA-2003:193
链接:http://www.redhat.com/support/errata/RHSA-2003-193.html

来源: DEBIAN
名称: DSA-361
链接:http://www.debian.org/security/2003/dsa-361

来源: FULLDISC
名称: 20030510 [forward]Apple Safari and Konqueror Embedded Common Name Verification Vulnerability
链接:http://lists.grok.org.uk/pipermail/full-disclosure/2003-May/004983.html

来源: BID
名称: 7520
链接:http://www.securityfocus.com/bid/7520