Secunia Advisory: SA9680 Print Advisory
Release Date: 2004-03-10
Last Update: 2004-03-11

Critical: Less critical
Impact: Security Bypass
Where: From remote

Software: KDE 2.x
KDE 3.x
Konqueror 3.x
Konqueror Embedded
Microsoft Internet Explorer 5.01
Microsoft Internet Explorer 5.5
Microsoft Internet Explorer 6
Mozilla 0.x
Mozilla 1.0
Mozilla 1.1
Mozilla 1.2
Mozilla 1.3
Mozilla 1.4
Mozilla Thunderbird 0.x
Opera 5.x
Opera 6.x
Opera 7.x
Safari 1.x


CVE reference: CAN-2003-0513
CAN-2003-0514
CAN-2003-0592
CAN-2003-0593
CAN-2003-0594

Description:
Corsaire has discovered a vulnerability in multiple vendors' browsers, which can be exploited by malicious people to bypass certain cookie restrictions.

A website can use a path argument for cookies in order to restrict the areas on the website for which a cookie applies and information therefore is exposed to.

However, it is possible to bypass the path restrictions specified by the cookie's originator due to validation errors in multiple browsers, which can be exploited via classic directory traversal character sequences.

This can potentially expose sensitive information stored in cookies associated with certain restricted sections of a site to malicious people, if e.g. a resource on the website outside the restricted area is vulnerable to cross-site scripting attacks.

Example:
http://[host]/restricted_area/%2e%2e/directory/insecure.cgi?xss=

Solution:
Many of the vendors involved have reportedly patched the issue silently in product releases made after July 2003. Users are therefore advised to update to the latest version of the affected products.

The advisory will be updated with further information when details about fixed versions are acquired.

Opera browser:
The vulnerability has been fixed in version 7.20 beta 7 and later.

KDE / Konqueror:
The vulnerability has been fixed in KDE 3.1.4 and later.

Mozilla:
The vulnerability has been fixed in version 1.4.1 and later.

Provided and/or discovered by:
Martin O'Neal of Corsaire.

Changelog:
2004-03-10: Added information about KDE/Konqueror fixes.
2004-03-11: Added information about Mozilla fixes.

Original Advisory:
Corsaire:
http://www.corsaire.co.uk/advisories/c030712-001.txt

Other References:
NISCC:
http://www.uniras.gov.uk/vuls/2004/180865/index.htm

Source: Secunia

OS/2-eCS-ArcaOS General News

More in General  

OS/2-eCS-ArcaOS Software News

More in Software  

Latest Forum Posts

WarpStock and OS/2-eCS-ArcaOS Event News

More in Events  

Site News

More in Site News