From: Secunia Security Advisories (sec-advsecunia.com)
Date: Wed Oct 20 2004 - 07:56:08 CDT

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

TITLE:
Konqueror Tabbed Browsing Vulnerability

SECUNIA ADVISORY ID:
SA12706

VERIFY ADVISORY:
http://secunia.com/advisories/12706/

CRITICAL:
Less critical

IMPACT:
Spoofing

WHERE:
From remote

SOFTWARE:
KDE 3.x
http://secunia.com/product/219/
Konqueror 3.x
http://secunia.com/product/3166/

DESCRIPTION:
Secunia Research has discovered a vulnerability in Konqueror, which
can be exploited by malicious web sites to spoof dialog boxes.

Inactive tabs can launch dialog boxes so they appear to be displayed
by a web site in another tab. This can be exploited by a malicious
web site to show a dialog box, which seems to originate from a
trusted web site.

Successful exploitation would normally require that a user is tricked
into opening a link from a malicious web site to a trusted web site in
a new tab.

A test is available here:
http://secunia.com/multiple_browsers_dialog_box_spoofing_test/

The vulnerability has been confirmed in Konqueror 3.2.2-6. Other
versions may also be vulnerable.

SOLUTION:
The vendor reports that the vulnerability has been fixed in KDE
3.3.1.

PROVIDED AND/OR DISCOVERED BY:
Jakob Balle, Secunia Research.

ORIGINAL ADVISORY:
http://secunia.com/secunia_research/2004-10/

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/

Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------

Unsubscribe: Secunia Security Advisories

----------------------------------------------------------------------

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]