Release Date: 2004-03-10
Last Update: 2004-03-11
Critical: Less critical
Impact: Security Bypass
Where: From remote
Software: KDE 2.x
KDE 3.x
Konqueror 3.x
Konqueror Embedded
Microsoft Internet Explorer 5.01
Microsoft Internet Explorer 5.5
Microsoft Internet Explorer 6
Mozilla 0.x
Mozilla 1.0
Mozilla 1.1
Mozilla 1.2
Mozilla 1.3
Mozilla 1.4
Mozilla Thunderbird 0.x
Opera 5.x
Opera 6.x
Opera 7.x
Safari 1.x
CVE reference: CAN-2003-0513
CAN-2003-0514
CAN-2003-0592
CAN-2003-0593
CAN-2003-0594
Description:
Corsaire has discovered a vulnerability in multiple vendors' browsers, which can be exploited by malicious people to bypass certain cookie restrictions.
A website can use a path argument for cookies in order to restrict the areas on the website for which a cookie applies and information therefore is exposed to.
However, it is possible to bypass the path restrictions specified by the cookie's originator due to validation errors in multiple browsers, which can be exploited via classic directory traversal character sequences.
This can potentially expose sensitive information stored in cookies associated with certain restricted sections of a site to malicious people, if e.g. a resource on the website outside the restricted area is vulnerable to cross-site scripting attacks.
Example: Solution: The advisory will be updated with further information when details about fixed versions are acquired. Opera browser: KDE / Konqueror: Mozilla: Provided and/or discovered by: Changelog: Original Advisory: Other References: Source: Secunia
http://[host]/restricted_area/%2e%2e/directory/insecure.cgi?xss=
Many of the vendors involved have reportedly patched the issue silently in product releases made after July 2003. Users are therefore advised to update to the latest version of the affected products.
The vulnerability has been fixed in version 7.20 beta 7 and later.
The vulnerability has been fixed in KDE 3.1.4 and later.
The vulnerability has been fixed in version 1.4.1 and later.
Martin O'Neal of Corsaire.
2004-03-10: Added information about KDE/Konqueror fixes.
2004-03-11: Added information about Mozilla fixes.
Corsaire:
http://www.corsaire.co.uk/advisories/c030712-001.txt
NISCC:
http://www.uniras.gov.uk/vuls/2004/180865/index.htm