The KDE HTML library (kdelibs), as used by Konqueror 3.5.5, does not properly parse HTML comments, which allows remote attackers to conduct cross-site scripting (XSS) attacks and bypass some XSS protection schemes by embedding certain HTML tags within a comment in a title tag, a related issue to CVE-2007-0478.

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2007-0909 advisory.

    [3.5.4-13.el5.0.1]
     - Remove Version branding
     - Maximum rpm trademark logos removed (pics/crystalsvg/*-mime-rpm*)

     [3.5.4-13.el5]
     - Resolves: #293571        CVE-2007-0537 Konqueror improper HTML comment rendering        CVE-2007-1564 FTP protocol PASV design flaw affects konqueror

     [3.5.4-12.el5]
     - resolves: #293421, CVE-2007-3820 CVE-2007-4224 CVE-2007-4225
     - Resolves: #293911, UTF-8 overlong sequence decoding vulnerability,      CVE-2007-0242
     - Resolves: #293571, Konqueror improper HTML comment rendering,      CVE-2007-0537

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Two cross-site-scripting flaws were found in the way Konqueror processes certain HTML content. This could result in a malicious attacker presenting misleading content to an unsuspecting user.
(CVE-2007-0242, CVE-2007-0537)

A flaw was found in KDE JavaScript implementation. A web page containing malicious JavaScript code could cause Konqueror to crash.
(CVE-2007-1308)

A flaw was found in the way Konqueror handled certain FTP PASV commands. A malicious FTP server could use this flaw to perform a rudimentary port-scan of machines behind a user's firewall.
(CVE-2007-1564)

Two Konqueror address spoofing flaws have been discovered. It was possible for a malicious website to cause the Konqueror address bar to display information which could trick a user into believing they are at a different website than they actually are. (CVE-2007-3820, CVE-2007-4224)

The KDE HTML library (kdelibs), as used by Konqueror 3.5.5, does not properly parse HTML comments, which allows remote attackers to conduct cross-site scripting (XSS) attacks and bypass some XSS protection schemes by embedding certain HTML tags within a comment in a title tag, a related issue to CVE-2007-0478. Also affects kdelibs 3.5.6, as per KDE official advisory.

Updated packages have been patched to prevent this.

A bug in KHTML could be exploited to conduct cross site scripting (XSS) attacks. (CVE-2007-0537)

Another bug allowed attackers to abuse the FTP passive mode for portscans. (CVE-2007-1564)

Jose Avila III and Robert Tasarz discovered that the KDE HTML library did not correctly parse HTML comments inside the 'title' tag. By tricking a Konqueror user into visiting a malicious website, an attacker could bypass cross-site scripting protections.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A bug in KHTML could be exploited to conduct cross site scripting (XSS) attacks (CVE-2007-0537).

Another bug allowed attackers to abuse the FTP passive mode for portscans (CVE-2007-1564).

Updated kdelibs packages that resolve several security flaws are now available for Red Hat Enterprise Linux 4 and 5.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

The kdelibs package provides libraries for the K Desktop Environment (KDE).

Two cross-site-scripting flaws were found in the way Konqueror processes certain HTML content. This could result in a malicious attacker presenting misleading content to an unsuspecting user.
(CVE-2007-0242, CVE-2007-0537)

A flaw was found in KDE JavaScript implementation. A web page containing malicious JavaScript code could cause Konqueror to crash.
(CVE-2007-1308)

A flaw was found in the way Konqueror handled certain FTP PASV commands. A malicious FTP server could use this flaw to perform a rudimentary port-scan of machines behind a user's firewall.
(CVE-2007-1564)

Two Konqueror address spoofing flaws have been discovered. It was possible for a malicious website to cause the Konqueror address bar to display information which could trick a user into believing they are at a different website than they actually are. (CVE-2007-3820, CVE-2007-4224)

Users of KDE should upgrade to these updated packages, which contain backported patches to correct these issues.

The remote Redhat Enterprise Linux 4 / 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2007:0909 advisory.

    The kdelibs package provides libraries for the K Desktop Environment (KDE).

    Two cross-site-scripting flaws were found in the way Konqueror processes     certain HTML content. This could result in a malicious attacker presenting     misleading content to an unsuspecting user. (CVE-2007-0242, CVE-2007-0537)

    A flaw was found in KDE JavaScript implementation.  A web page containing     malicious JavaScript code could cause Konqueror to crash. (CVE-2007-1308)

    A flaw was found in the way Konqueror handled certain FTP PASV commands.
    A malicious FTP server could use this flaw to perform a rudimentary     port-scan of machines behind a user's firewall. (CVE-2007-1564)

    Two Konqueror address spoofing flaws have been discovered. It was     possible for a malicious website to cause the Konqueror address bar to     display information which could trick a user into believing they are at a     different website than they actually are. (CVE-2007-3820, CVE-2007-4224)

    Users of KDE should upgrade to these updated packages, which contain     backported patches to correct these issues.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-200703-10 (KHTML: XSS (XSS) vulnerability)

    The KHTML code allows for the execution of JavaScript code located     inside the 'Title' HTML element, a related issue to the Safari error     found by Jose Avila.
  Impact :

    When viewing a HTML page that renders unsanitized attacker-supplied     input in the page title, Konqueror and other parts of KDE will execute     arbitrary JavaScript code contained in the page title, allowing for the     theft of browser session data or cookies.
  Workaround :

    There is no known workaround at this time.

Konqueror 3.5.5 does not properly parse HTML comments in title tags, which allows remote attackers to conduct cross-site scripting (XSS) attacks and bypass some XSS protection schemes by embedding certain HTML tags within a comment, a related issue to CVE-2007-0478.

Updated packages have been patched to correct this issue.

ID	Name	Product	Family	Severity
67574	Oracle Linux 5 : Moderate: / kdelibs (ELSA-2007-0909)	Nessus	Oracle Linux Local Security Checks	medium
60263	Scientific Linux Security Update : kdelibs on SL5.x, SL4.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	medium
36567	Mandrake Linux Security Advisory : kdelibs (MDKSA-2007:157)	Nessus	Mandriva Local Security Checks	low
29482	SuSE 10 Security Update : kdelibs3 (ZYPP Patch Number 3053)	Nessus	SuSE Local Security Checks	medium
28012	Ubuntu 5.10 / 6.06 LTS / 6.10 : kdelibs vulnerability (USN-420-1)	Nessus	Ubuntu Local Security Checks	low
27289	openSUSE 10 Security Update : kdelibs3 (kdelibs3-3058)	Nessus	SuSE Local Security Checks	medium
26974	CentOS 4 / 5 : kdelibs (CESA-2007:0909)	Nessus	CentOS Local Security Checks	medium
26952	RHEL 4 / 5 : kdelibs (RHSA-2007:0909)	Nessus	Red Hat Local Security Checks	medium
24802	GLSA-200703-10 : KHTML: XSS (XSS) vulnerability	Nessus	Gentoo Local Security Checks	medium
24644	Mandrake Linux Security Advisory : kdelibs (MDKSA-2007:031)	Nessus	Mandriva Local Security Checks	low

Detections

Analytics

CVE-2007-0537

medium

Tenable Plugins

medium

medium

low

medium

low

medium

medium

medium

medium

low