KDE 3.2.x and 3.3.0 through 3.3.2, when saving credentials that are (1) manually entered by the user or (2) created by the SMB protocol handler, stores those credentials for plaintext in the user's .desktop file, which may be created with world-readable permissions, which could allow local users to obtain usernames and passwords for remote resources such as SMB shares.

When browsing SMB shares with Konqueror, shares with authentication show up with hidden password in the browser bar. It is possible to store the URL as a shortcut on the desktop where the password is then available in plain text.

The remote host is affected by the vulnerability described in GLSA-200412-16 (kdelibs, kdebase: Multiple vulnerabilities)

    Daniel Fabian discovered that the KDE core libraries contain a     flaw allowing password disclosure by making a link to a remote file.
    When creating this link, the resulting URL contains authentication     credentials used to access the remote file (CAN 2004-1171).
    The Konqueror webbrowser allows websites to load webpages into a window     or tab currently used by another website (CAN-2004-1158).
  Impact :

    A malicious user could have access to the authentication     credentials of other users depending on the file permissions.
    A malicious website could use the window injection vulnerability to     load content in a window apparently belonging to another website.
  Workaround :

    There is no known workaround at this time.

Daniel Fabian discovered a potential privacy issue in KDE. When creating a link to a remote file from various applications, including Konqueror, the resulting URL may contain the authentication credentials used to access that remote resource. This includes, but is not limited to, browsing SMB (Samba) shares. Upon further investigation, it was found that the SMB protocol handler also unnecessarily exposed authentication credentials (CVE-2004-1171).

Another vulnerability was discovered where a malicious website could abuse Konqueror to load its own content into a window or tab that was opened by a trusted website, or it could trick a trusted website into loading content into an existing window or tab. This could lead to the user being confused as to the origin of a particular webpage and could have the user unknowingly send confidential information intended for a trusted site to the malicious site (CVE-2004-1158).

The updated packages contain a patch from the KDE team to solve this issue.

Additionally, the kdelibs and kdebase packages for Mandrakelinux 10.1 contain numerous bugfixes. New qt3 packages are being provided for Mandrakelinux 10.0 that are required to build the kdebase package.

ID	Name	Product	Family	Severity
18921	FreeBSD : konqueror -- Password Disclosure for SMB Shares (4593cb09-4c81-11d9-983e-000c6e8f12ef)	Nessus	FreeBSD Local Security Checks	low
16003	GLSA-200412-16 : kdelibs, kdebase: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
15981	Mandrake Linux Security Advisory : kdelibs (MDKSA-2004:150)	Nessus	Mandriva Local Security Checks	high

Detections

Analytics

CVE-2004-1171

medium

Tenable Plugins

low

high

high