[SM-Security] [Bug 3881] New: Konqueror authentication credentials leak (KDE <= 3.1.2)
bugzilla-daemon at metalab.unc.edu
bugzilla-daemon at metalab.unc.edu
Sat Aug 2 09:42:41 EDT 2003
http://bugs.sourcemage.org/show_bug.cgi?id=3881
Summary: Konqueror authentication credentials leak (KDE <= 3.1.2)
Product: Security
Version: unspecified
Platform: Other
URL: http://www.kde.org/info/security/advisory-20030729-1.txt
OS/Version: other
Status: NEW
Severity: normal
Priority: P2
Component: Security Issue
AssignedTo: sm-security at lists.ibiblio.org
ReportedBy: g.clay at warwick.ac.uk
The KDE team have identified a security leak in the Konqueror browser. Here's an excerpt from their
security advisory:
"Konqueror may inadvertently send authentication credentials to
websites other than the intended website in clear text via the HTTP-referer
header when authentication credentials are passed as part of a URL in the form
of http://user:password@host/"
The fix is to upgrade to KDE 3.1.3, which was released recently. Hopefully it should just be a case of
bumping some version numbers :)
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
More information about the SM-Security
mailing list