kio/kio/tcpslavebase.cpp in KDE KSSL in kdelibs before 4.6.1 does not properly verify that the server hostname matches the domain name of the subject of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a certificate issued by a legitimate Certification Authority for an IP address, a different vulnerability than CVE-2009-2702.

The remote host is affected by the vulnerability described in GLSA-201406-34 (KDE Libraries: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in KDE Libraries. Please       review the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could cause a man-in-the-middle attack via any       certificate issued by a legitimate certification authority. Furthermore,       a local attacker may gain knowledge of user passwords through an       information leak.
  Workaround :

    There is no known workaround at this time.

KSSL did not properly verify the host name of a certificate if the certificate was issued for an IP address (CVE-2011-1094).

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2011-0464 advisory.

    - rebase the fix for CVE-2011-1094

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

A cross-site scripting (XSS) flaw was found in the way KHTML, the HTML layout engine used by KDE applications such as the Konqueror web browser, displayed certain error pages. A remote attacker could use this flaw to perform a cross-site scripting attack against victims by tricking them into visiting a specially crafted URL. (CVE-2011-1168)

A flaw was found in the way kdelibs checked the user specified hostname against the name in the server's SSL certificate. A man-in-the-middle attacker could use this flaw to trick an application using kdelibs into mistakenly accepting a certificate as if it was valid for the host, if that certificate was issued for an IP address to which the user specified hostname was resolved to. (CVE-2011-1094)

Note: As part of the fix for CVE-2011-1094, this update also introduces stricter handling for wildcards used in servers' SSL certificates.

The desktop must be restarted (log out, then log back in) for this update to take effect.

It was discovered that KDE KSSL did not properly verify X.509 certificates when the certificate was issued for an IP address. An attacker could exploit this to perform a man in the middle attack to view sensitive information or alter encrypted communications.
(CVE-2011-1094)

Tim Brown discovered that KDE KHTML did not properly escape URLs from externally generated error pages. An attacker could exploit this to conduct cross-site scripting attacks. With cross-site scripting vulnerabilities, if a user were tricked into viewing server output during a crafted server request, a remote attacker could exploit this to modify the contents, or steal confidential data (such as passwords), within the same domain. (CVE-2011-1168).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2011:0464 advisory.

    The kdelibs packages provide libraries for the K Desktop Environment (KDE).

    A cross-site scripting (XSS) flaw was found in the way KHTML, the HTML     layout engine used by KDE applications such as the Konqueror web browser,     displayed certain error pages. A remote attacker could use this flaw to     perform a cross-site scripting attack against victims by tricking them into     visiting a specially-crafted URL. (CVE-2011-1168)

    A flaw was found in the way kdelibs checked the user specified hostname     against the name in the server's SSL certificate. A man-in-the-middle     attacker could use this flaw to trick an application using kdelibs into     mistakenly accepting a certificate as if it was valid for the host, if that     certificate was issued for an IP address to which the user specified     hostname was resolved to. (CVE-2011-1094)

    Note: As part of the fix for CVE-2011-1094, this update also introduces     stricter handling for wildcards used in servers' SSL certificates.

    Users should upgrade to these updated packages, which contain backported     patches to correct these issues. The desktop must be restarted (log out,     then log back in) for this update to take effect.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

A vulnerability has been found and corrected in kdelibs4 :

kio/kio/tcpslavebase.cpp in KDE KSSL in kdelibs before 4.6.1 does not properly verify that the server hostname matches the domain name of the subject of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a certificate issued by a legitimate Certification Authority for an IP address, a different vulnerability than CVE-2009-2702 (CVE-2011-1094).

Additionally it was discovered that kdelibs4 for 2009.0 was using an old private copy of the ca-bundle.crt file containing the root CA certs, this has now been resolved so that it uses the system wide and up to date /etc/pki/tls/certs/ca-bundle.crt file last updated with the MDVSA-2011:068 advisory.

Packages for 2009.0 are provided as of the Extended Maintenance Program. Please visit this link to learn more:
http://store.mandriva.com/product_info.php?cPath=149 products_id=490

The updated packages have been patched to correct this issue.

KSSL did not properly verify the host name of a certificate if the certificate was issued for an IP address (CVE-2011-1094). This has been fixed.

ID	Name	Product	Family	Severity
76305	GLSA-201406-34 : KDE Libraries: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	medium
75876	openSUSE Security Update : kdelibs4 (openSUSE-SU-2011:0281-1)	Nessus	SuSE Local Security Checks	medium
75545	openSUSE Security Update : kdelibs4 (openSUSE-SU-2011:0281-1)	Nessus	SuSE Local Security Checks	medium
68259	Oracle Linux 6 : kdelibs (ELSA-2011-0464)	Nessus	Oracle Linux Local Security Checks	medium
61023	Scientific Linux Security Update : kdelibs on SL6.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	medium
55068	Ubuntu 9.10 / 10.04 LTS / 10.10 : kde4libs vulnerabilities (USN-1110-1)	Nessus	Ubuntu Local Security Checks	medium
53738	openSUSE Security Update : kdelibs4 (openSUSE-SU-2011:0280-1)	Nessus	SuSE Local Security Checks	medium
53525	RHEL 6 : kdelibs (RHSA-2011:0464)	Nessus	Red Hat Local Security Checks	medium
53350	Mandriva Linux Security Advisory : kdelibs4 (MDVSA-2011:071)	Nessus	Mandriva Local Security Checks	medium
53284	SuSE 11.1 Security Update : kdelibs4 (SAT Patch Number 4217)	Nessus	SuSE Local Security Checks	medium

Detections

Analytics

CVE-2011-1094

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium