Konqueror 3.x up to 3.2.2-6, and possibly other versions, allows remote attackers to spoof arbitrary web sites by injecting content from one window into a target window or tab whose name is known but resides in a different domain, as demonstrated using a pop-up window on a trusted web site, aka the "window injection" vulnerability.

A Secunia Research advisory reports :

Secunia Research has reported a vulnerability in multiple browsers, which can be exploited by malicious people to spoof the content of websites.

The problem is that a website can inject content into another site's window if the target name of the window is known. This can e.g. be exploited by a malicious website to spoof the content of a pop-up window opened on a trusted website.

Secunia has constructed a test, which can be used to check if your browser is affected by this issue :
http://secunia.com/multiple_browsers_window_injection_vulnerability_te st/

A workaround for Mozilla-based browsers is available.

Updated kdelib and kdebase packages that resolve several security issues are now available.

The kdelibs packages include libraries for the K Desktop Environment.
The kdebase packages include core applications for the K Desktop Environment.

Secunia Research discovered a window injection spoofing vulnerability affecting the Konqueror web browser. This issue could allow a malicious website to show arbitrary content in a different browser window. The Common Vulnerabilities and Exposures project has assigned the name CVE-2004-1158 to this issue.

A bug was discovered in the way kioslave handles URL-encoded newline (%0a) characters before the FTP command. It is possible that a specially crafted URL could be used to execute any ftp command on a remote server, or potentially send unsolicited email. The Common Vulnerabilities and Exposures project has assigned the name CVE-2004-1165 to this issue.

A bug was discovered that can crash KDE screensaver under certain local circumstances. This could allow an attacker with physical access to the workstation to take over a locked desktop session. Please note that this issue only affects Red Hat Enterprise Linux 2.1. The Common Vulnerabilities and Exposures project has assigned the name CVE-2005-0078 to this issue.

All users of KDE are advised to upgrade to this updated packages, which contain backported patches to correct these issues.

The remote host is using a version of Konqueror that is prone to a security flaw that may allow a malicious website to influence a pop up window from a trusted site.
An attacker may exploit this flaw to impersonate third-party web servers and convince a victim on the remote host into revealing personal information. 

The remote host is affected by the vulnerability described in GLSA-200412-16 (kdelibs, kdebase: Multiple vulnerabilities)

    Daniel Fabian discovered that the KDE core libraries contain a     flaw allowing password disclosure by making a link to a remote file.
    When creating this link, the resulting URL contains authentication     credentials used to access the remote file (CAN 2004-1171).
    The Konqueror webbrowser allows websites to load webpages into a window     or tab currently used by another website (CAN-2004-1158).
  Impact :

    A malicious user could have access to the authentication     credentials of other users depending on the file permissions.
    A malicious website could use the window injection vulnerability to     load content in a window apparently belonging to another website.
  Workaround :

    There is no known workaround at this time.

Daniel Fabian discovered a potential privacy issue in KDE. When creating a link to a remote file from various applications, including Konqueror, the resulting URL may contain the authentication credentials used to access that remote resource. This includes, but is not limited to, browsing SMB (Samba) shares. Upon further investigation, it was found that the SMB protocol handler also unnecessarily exposed authentication credentials (CVE-2004-1171).

Another vulnerability was discovered where a malicious website could abuse Konqueror to load its own content into a window or tab that was opened by a trusted website, or it could trick a trusted website into loading content into an existing window or tab. This could lead to the user being confused as to the origin of a particular webpage and could have the user unknowingly send confidential information intended for a trusted site to the malicious site (CVE-2004-1158).

The updated packages contain a patch from the KDE team to solve this issue.

Additionally, the kdelibs and kdebase packages for Mandrakelinux 10.1 contain numerous bugfixes. New qt3 packages are being provided for Mandrakelinux 10.0 that are required to build the kdebase package.

ID	Name	Product	Family	Severity
19083	FreeBSD : web browsers -- window injection vulnerabilities (b0911985-6e2a-11d9-9557-000a95bc6fae)	Nessus	FreeBSD Local Security Checks	high
16366	RHEL 2.1 / 3 : kdelibs, kdebase (RHSA-2005:009)	Nessus	Red Hat Local Security Checks	high
2531	Konqueror Web Browser < 3.3.3 Remote Window Hijacking	Nessus Network Monitor	Web Clients	low
16003	GLSA-200412-16 : kdelibs, kdebase: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
15981	Mandrake Linux Security Advisory : kdelibs (MDKSA-2004:150)	Nessus	Mandriva Local Security Checks	high

Detections

Analytics

CVE-2004-1158

medium

Tenable Plugins

high

high

low

high

high