kpac/script.cpp in KDE kio before 5.32 and kdelibs before 4.14.30 calls the PAC FindProxyForURL function with a full https URL (potentially including Basic Authentication credentials, a query string, or PATH_INFO), which allows remote attackers to obtain sensitive information via a crafted PAC file.

Several vulnerabilities were discovered in kde4libs, the core libraries for all KDE 4 applications. The Common Vulnerabilities and Exposures project identifies the following problems :

CVE-2017-6410

Itzik Kotler, Yonatan Fridburg and Amit Klein of Safebreach Labs reported that URLs are not sanitized before passing them to FindProxyForURL, potentially allowing a remote attacker to obtain sensitive information via a crafted PAC file.

CVE-2017-8422

Sebastian Krahmer from SUSE discovered that the KAuth framework contains a logic flaw in which the service invoking dbus is not properly checked. This flaw allows spoofing the identity of the caller and gaining root privileges from an unprivileged account.

CVE-2013-2074

It was discovered that KIO would show web authentication credentials in some error cases.

For Debian 7 'Wheezy', these problems have been fixed in version 4:4.8.4-4+deb7u3.

We recommend that you upgrade your kde4libs packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several vulnerabilities were discovered in kde4libs, the core libraries for all KDE 4 applications. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2017-6410     Itzik Kotler, Yonatan Fridburg and Amit Klein of     Safebreach Labs reported that URLs are not sanitized     before passing them to FindProxyForURL, potentially     allowing a remote attacker to obtain sensitive     information via a crafted PAC file.

  - CVE-2017-8422     Sebastian Krahmer from SUSE discovered that the KAuth     framework contains a logic flaw in which the service     invoking dbus is not properly checked. This flaw allows     spoofing the identity of the caller and gaining root     privileges from an unprivileged account.

This update for kdelibs4, kio fixes the following issues :

  - CVE-2017-6410: Information Leak when accessing https     when using a malicious PAC file (boo#1027520)

Security fix for CVE-2017-6410

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This kdelibs3 (KDE 3 compatibility libraries) update fixes the security issues :

  - CVE-2016-6232 (karchive): Extraction of tar files     possible to arbitrary system locations

  - CVE-2017-6410 (kio): Information Leak when accessing     https when using a malicious PAC file

for the KDE 3 compatibility libraries. (Security updates for KDE Frameworks 5 (kf5-karchive resp. kf5-kio) and for the KDE 4 compatibility libraries (kdelibs 4) have already been submitted.)

In addition, the KDE 3 compatibility version of KCrash was modified to use the DrKonqi from Plasma 5 rather than from kde-runtime 4. (The original KDE 3 DrKonqi was already dropped years ago.) The kde-runtime 4 DrKonqi is not installed by default and will be removed entirely in future Fedora versions, the Plasma 5 version of DrKonqi can also be used for legacy applications.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Itzik Kotler, Yonatan Fridburg, and Amit Klein discovered that KDE-Libs incorrectly handled certain PAC files. A remote attacker could possibly use this issue to obtain sensitive information.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
100431	Debian DLA-952-1 : kde4libs security update	Nessus	Debian Local Security Checks	high
100163	Debian DSA-3849-1 : kde4libs - security update	Nessus	Debian Local Security Checks	high
97715	openSUSE Security Update : kdelibs4 / kio (openSUSE-2017-334)	Nessus	SuSE Local Security Checks	medium
97681	Fedora 24 : 6:kdelibs (2017-b011e8c922)	Nessus	Fedora Local Security Checks	medium
97678	Fedora 25 : kdelibs3 (2017-4f4eef4791)	Nessus	Fedora Local Security Checks	high
97672	Fedora 24 : kdelibs3 (2017-01eed6fe8c)	Nessus	Fedora Local Security Checks	high
97658	Ubuntu 14.04 LTS : KDE-Libs vulnerability (USN-3223-1)	Nessus	Ubuntu Local Security Checks	medium
97543	Fedora 25 : kf5-kio (2017-f9ab92fa6c)	Nessus	Fedora Local Security Checks	medium
97534	Fedora 25 : 6:kdelibs (2017-53338ece0c)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2017-6410

medium

Tenable Plugins

high

high

medium

medium

high

high

medium

medium

medium