Vulnerabilities > CVE-2007-1564 - Information Exposure vulnerability in KDE Konqueror 3.5.5
Attack vector
NETWORK Attack complexity
MEDIUM Privileges required
NONE Confidentiality impact
PARTIAL Integrity impact
PARTIAL Availability impact
PARTIAL Summary
The FTP protocol implementation in Konqueror 3.5.5 allows remote servers to force the client to connect to other servers, perform a proxied port scan, or obtain sensitive information by specifying an alternate server address in an FTP PASV response.
Vulnerable Configurations
Part | Description | Count |
---|---|---|
Application | 1 |
Common Weakness Enumeration (CWE)
Common Attack Pattern Enumeration and Classification (CAPEC)
- Subverting Environment Variable Values The attacker directly or indirectly modifies environment variables used by or controlling the target software. The attacker's goal is to cause the target software to deviate from its expected operation in a manner that benefits the attacker.
- Footprinting An attacker engages in probing and exploration activity to identify constituents and properties of the target. Footprinting is a general term to describe a variety of information gathering techniques, often used by attackers in preparation for some attack. It consists of using tools to learn as much as possible about the composition, configuration, and security mechanisms of the targeted application, system or network. Information that might be collected during a footprinting effort could include open ports, applications and their versions, network topology, and similar information. While footprinting is not intended to be damaging (although certain activities, such as network scans, can sometimes cause disruptions to vulnerable applications inadvertently) it may often pave the way for more damaging attacks.
- Exploiting Trust in Client (aka Make the Client Invisible) An attack of this type exploits a programs' vulnerabilities in client/server communication channel authentication and data integrity. It leverages the implicit trust a server places in the client, or more importantly, that which the server believes is the client. An attacker executes this type of attack by placing themselves in the communication channel between client and server such that communication directly to the server is possible where the server believes it is communicating only with a valid client. There are numerous variations of this type of attack.
- Browser Fingerprinting An attacker carefully crafts small snippets of Java Script to efficiently detect the type of browser the potential victim is using. Many web-based attacks need prior knowledge of the web browser including the version of browser to ensure successful exploitation of a vulnerability. Having this knowledge allows an attacker to target the victim with attacks that specifically exploit known or zero day weaknesses in the type and version of the browser used by the victim. Automating this process via Java Script as a part of the same delivery system used to exploit the browser is considered more efficient as the attacker can supply a browser fingerprinting method and integrate it with exploit code, all contained in Java Script and in response to the same web page request by the browser.
- Session Credential Falsification through Prediction This attack targets predictable session ID in order to gain privileges. The attacker can predict the session ID used during a transaction to perform spoofing and session hijacking.
Exploit-Db
description | KDE Konqueror 3.x/IOSlave FTP PASV Port-Scanning Vulnerability. CVE-2007-1564. Remote exploit for linux platform |
id | EDB-ID:29770 |
last seen | 2016-02-03 |
modified | 2007-03-21 |
published | 2007-03-21 |
reporter | mark |
source | https://www.exploit-db.com/download/29770/ |
title | KDE Konqueror 3.x/IOSlave - FTP PASV Port-Scanning Vulnerability |
Nessus
NASL family SuSE Local Security Checks NASL id SUSE_KDELIBS3-3988.NASL description A bug in konqueror allowed attackers to abuse the FTP passive mode for portscans. (CVE-2007-1564) last seen 2020-06-01 modified 2020-06-02 plugin id 29483 published 2007-12-13 reporter This script is Copyright (C) 2007-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/29483 title SuSE 10 Security Update : kdelibs3,kdelibs3-devel,CVE-2007-1564 (ZYPP Patch Number 3988) code #%NASL_MIN_LEVEL 80502 # # (C) Tenable Network Security, Inc. # # The text description of this plugin is (C) Novell, Inc. # include("compat.inc"); if (description) { script_id(29483); script_version ("1.15"); script_cvs_date("Date: 2019/10/25 13:36:30"); script_cve_id("CVE-2007-1564"); script_name(english:"SuSE 10 Security Update : kdelibs3,kdelibs3-devel,CVE-2007-1564 (ZYPP Patch Number 3988)"); script_summary(english:"Checks rpm output for the updated packages"); script_set_attribute( attribute:"synopsis", value:"The remote SuSE 10 host is missing a security-related patch." ); script_set_attribute( attribute:"description", value: "A bug in konqueror allowed attackers to abuse the FTP passive mode for portscans. (CVE-2007-1564)" ); script_set_attribute( attribute:"see_also", value:"http://support.novell.com/security/cve/CVE-2007-1564.html" ); script_set_attribute(attribute:"solution", value:"Apply ZYPP patch number 3988."); script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"cpe:/o:suse:suse_linux"); script_set_attribute(attribute:"patch_publication_date", value:"2007/08/01"); script_set_attribute(attribute:"plugin_publication_date", value:"2007/12/13"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2007-2019 Tenable Network Security, Inc."); script_family(english:"SuSE Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/SuSE/release", "Host/SuSE/rpm-list"); exit(0); } include("global_settings.inc"); include("rpm.inc"); if (!get_kb_item("Host/local_checks_enabled")) exit(0, "Local checks are not enabled."); if (!get_kb_item("Host/SuSE/release")) exit(0, "The host is not running SuSE."); if (!get_kb_item("Host/SuSE/rpm-list")) exit(1, "Could not obtain the list of installed packages."); cpu = get_kb_item("Host/cpu"); if (isnull(cpu)) exit(1, "Failed to determine the architecture type."); if (cpu >!< "x86_64" && cpu !~ "^i[3-6]86$") exit(1, "Local checks for SuSE 10 on the '"+cpu+"' architecture have not been implemented."); flag = 0; if (rpm_check(release:"SLED10", sp:1, reference:"kdelibs3-3.5.1-49.38")) flag++; if (rpm_check(release:"SLED10", sp:1, reference:"kdelibs3-devel-3.5.1-49.38")) flag++; if (rpm_check(release:"SLED10", sp:1, cpu:"x86_64", reference:"kdelibs3-32bit-3.5.1-49.38")) flag++; if (rpm_check(release:"SLES10", sp:1, reference:"kdelibs3-3.5.1-49.38")) flag++; if (rpm_check(release:"SLES10", sp:1, reference:"kdelibs3-devel-3.5.1-49.38")) flag++; if (rpm_check(release:"SLES10", sp:1, cpu:"x86_64", reference:"kdelibs3-32bit-3.5.1-49.38")) flag++; if (flag) { if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get()); else security_warning(0); exit(0); } else exit(0, "The host is not affected.");
NASL family SuSE Local Security Checks NASL id SUSE_KDELIBS3-3058.NASL description A bug in KHTML could be exploited to conduct cross site scripting (XSS) attacks (CVE-2007-0537). Another bug allowed attackers to abuse the FTP passive mode for portscans (CVE-2007-1564). last seen 2020-06-01 modified 2020-06-02 plugin id 27289 published 2007-10-17 reporter This script is Copyright (C) 2007-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/27289 title openSUSE 10 Security Update : kdelibs3 (kdelibs3-3058) NASL family Scientific Linux Local Security Checks NASL id SL_20071008_KDELIBS_ON_SL5_X.NASL description Two cross-site-scripting flaws were found in the way Konqueror processes certain HTML content. This could result in a malicious attacker presenting misleading content to an unsuspecting user. (CVE-2007-0242, CVE-2007-0537) A flaw was found in KDE JavaScript implementation. A web page containing malicious JavaScript code could cause Konqueror to crash. (CVE-2007-1308) A flaw was found in the way Konqueror handled certain FTP PASV commands. A malicious FTP server could use this flaw to perform a rudimentary port-scan of machines behind a user last seen 2020-06-01 modified 2020-06-02 plugin id 60263 published 2012-08-01 reporter This script is Copyright (C) 2012-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/60263 title Scientific Linux Security Update : kdelibs on SL5.x, SL4.x i386/x86_64 NASL family Red Hat Local Security Checks NASL id REDHAT-RHSA-2007-0909.NASL description Updated kdelibs packages that resolve several security flaws are now available for Red Hat Enterprise Linux 4 and 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. The kdelibs package provides libraries for the K Desktop Environment (KDE). Two cross-site-scripting flaws were found in the way Konqueror processes certain HTML content. This could result in a malicious attacker presenting misleading content to an unsuspecting user. (CVE-2007-0242, CVE-2007-0537) A flaw was found in KDE JavaScript implementation. A web page containing malicious JavaScript code could cause Konqueror to crash. (CVE-2007-1308) A flaw was found in the way Konqueror handled certain FTP PASV commands. A malicious FTP server could use this flaw to perform a rudimentary port-scan of machines behind a user last seen 2020-06-01 modified 2020-06-02 plugin id 26952 published 2007-10-09 reporter This script is Copyright (C) 2007-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/26952 title RHEL 4 / 5 : kdelibs (RHSA-2007:0909) NASL family Oracle Linux Local Security Checks NASL id ORACLELINUX_ELSA-2007-0909.NASL description From Red Hat Security Advisory 2007:0909 : Updated kdelibs packages that resolve several security flaws are now available for Red Hat Enterprise Linux 4 and 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. The kdelibs package provides libraries for the K Desktop Environment (KDE). Two cross-site-scripting flaws were found in the way Konqueror processes certain HTML content. This could result in a malicious attacker presenting misleading content to an unsuspecting user. (CVE-2007-0242, CVE-2007-0537) A flaw was found in KDE JavaScript implementation. A web page containing malicious JavaScript code could cause Konqueror to crash. (CVE-2007-1308) A flaw was found in the way Konqueror handled certain FTP PASV commands. A malicious FTP server could use this flaw to perform a rudimentary port-scan of machines behind a user last seen 2020-06-01 modified 2020-06-02 plugin id 67574 published 2013-07-12 reporter This script is Copyright (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/67574 title Oracle Linux 4 / 5 : kdelibs (ELSA-2007-0909) NASL family CentOS Local Security Checks NASL id CENTOS_RHSA-2007-0909.NASL description Updated kdelibs packages that resolve several security flaws are now available for Red Hat Enterprise Linux 4 and 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. The kdelibs package provides libraries for the K Desktop Environment (KDE). Two cross-site-scripting flaws were found in the way Konqueror processes certain HTML content. This could result in a malicious attacker presenting misleading content to an unsuspecting user. (CVE-2007-0242, CVE-2007-0537) A flaw was found in KDE JavaScript implementation. A web page containing malicious JavaScript code could cause Konqueror to crash. (CVE-2007-1308) A flaw was found in the way Konqueror handled certain FTP PASV commands. A malicious FTP server could use this flaw to perform a rudimentary port-scan of machines behind a user last seen 2020-06-01 modified 2020-06-02 plugin id 26974 published 2007-10-12 reporter This script is Copyright (C) 2007-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/26974 title CentOS 4 / 5 : kdelibs (CESA-2007:0909) NASL family Mandriva Local Security Checks NASL id MANDRAKE_MDKSA-2007-072.NASL description The FTP protocol implementation in Konqueror 3.5.5 allows remote servers to force the client to connect to other servers, perform a proxied port scan, or obtain sensitive information by specifying an alternate server address in a FTP PASV command. Updated packages have been patched to address this issue. last seen 2020-06-01 modified 2020-06-02 plugin id 24940 published 2007-04-05 reporter This script is Copyright (C) 2007-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/24940 title Mandrake Linux Security Advisory : kdelibs (MDKSA-2007:072) NASL family Ubuntu Local Security Checks NASL id UBUNTU_USN-447-1.NASL description It was discovered that Konqueror did not correctly handle iframes from JavaScript. If a user were tricked into visiting a malicious website, Konqueror could crash, resulting in a denial of service. (CVE-2007-1308) A flaw was discovered in how Konqueror handled PASV FTP responses. If a user were tricked into visiting a malicious FTP server, a remote attacker could perform a port-scan of machines within the user last seen 2020-06-01 modified 2020-06-02 plugin id 28044 published 2007-11-10 reporter Ubuntu Security Notice (C) 2007-2019 Canonical, Inc. / NASL script (C) 2018 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/28044 title Ubuntu 5.10 / 6.06 LTS / 6.10 : kdelibs vulnerabilities (USN-447-1) NASL family SuSE Local Security Checks NASL id SUSE_KDELIBS3-3053.NASL description A bug in KHTML could be exploited to conduct cross site scripting (XSS) attacks. (CVE-2007-0537) Another bug allowed attackers to abuse the FTP passive mode for portscans. (CVE-2007-1564) last seen 2020-06-01 modified 2020-06-02 plugin id 29482 published 2007-12-13 reporter This script is Copyright (C) 2007-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/29482 title SuSE 10 Security Update : kdelibs3 (ZYPP Patch Number 3053)
Oval
accepted | 2013-04-29T04:07:23.549-04:00 | ||||||||||||||||||||||||
class | vulnerability | ||||||||||||||||||||||||
contributors |
| ||||||||||||||||||||||||
definition_extensions |
| ||||||||||||||||||||||||
description | The FTP protocol implementation in Konqueror 3.5.5 allows remote servers to force the client to connect to other servers, perform a proxied port scan, or obtain sensitive information by specifying an alternate server address in an FTP PASV response. | ||||||||||||||||||||||||
family | unix | ||||||||||||||||||||||||
id | oval:org.mitre.oval:def:10646 | ||||||||||||||||||||||||
status | accepted | ||||||||||||||||||||||||
submitted | 2010-07-09T03:56:16-04:00 | ||||||||||||||||||||||||
title | The FTP protocol implementation in Konqueror 3.5.5 allows remote servers to force the client to connect to other servers, perform a proxied port scan, or obtain sensitive information by specifying an alternate server address in an FTP PASV response. | ||||||||||||||||||||||||
version | 27 |
Redhat
advisories |
| ||||
rpms |
|
Statements
contributor | Joshua Bressers |
lastmodified | 2007-03-23 |
organization | Red Hat |
statement | Red Hat is aware of this issue and is tracking it via the following bug: https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=233592 The Red Hat Security Response Team has rated this issue as having low security impact, a future update may address this flaw. More information regarding issue severity can be found here: http://www.redhat.com/security/updates/classification/ |
References
- http://bindshell.net/papers/ftppasv/ftp-client-pasv-manipulation.pdf
- http://secunia.com/advisories/24889
- http://secunia.com/advisories/27108
- http://securitytracker.com/id?1017801
- http://www.kde.org/info/security/advisory-20070326-1.txt
- http://www.mandriva.com/security/advisories?name=MDKSA-2007:072
- http://www.novell.com/linux/security/advisories/2007_6_sr.html
- http://www.redhat.com/support/errata/RHSA-2007-0909.html
- http://www.securityfocus.com/bid/23091
- http://www.ubuntu.com/usn/usn-447-1
- http://www.vupen.com/english/advisories/2007/1076
- https://issues.rpath.com/browse/RPL-1201
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10646