CVE-2013-2074: Infoleak
First published: Fri May 10 2013(Updated: )
It was reported [1] that when KDE encounters an "internal server error" and also prints out the URL that caused the error that it would include the username and password (if supplied) to the resource that caused the error. For instance, it would show "<a href="https://user:password@remotehost.com">https://user:password@remotehost.com</a>" or similar. This is due to kioslave/http/http.cpp using m_request.url.url() rather than the sanitized m_request.url.prettyUrl(). This issue is fixed in git [2]. Note that this information is printed out to the local user actively using the computer. [1] <a href="https://bugs.kde.org/show_bug.cgi?id=319428">https://bugs.kde.org/show_bug.cgi?id=319428</a> [2] <a href="https://projects.kde.org/projects/kde/kdelibs/repository/revisions/65d736dab592bced4410ccfa4699de89f78c96ca/diff/kioslave/http/http.cpp">https://projects.kde.org/projects/kde/kdelibs/repository/revisions/65d736dab592bced4410ccfa4699de89f78c96ca/diff/kioslave/http/http.cpp</a>
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| KDE kdelibs | <=4.10.3 | |
| KDE kdelibs | =4.10.0 | |
| KDE kdelibs | =4.10.1 | |
| KDE kdelibs | =4.10.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://user:password@remotehost.com
- https://bugs.kde.org/show_bug.cgi?id=319428
- https://projects.kde.org/projects/kde/kdelibs/repository/revisions/65d736dab592bced4410ccfa4699de89f78c96ca/diff/kioslave/http/http.cpp
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=961982
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=962001
- http://www.openwall.com/lists/oss-security/2013/05/11/2
- https://access.redhat.com/security/cve/CVE-2013-2074
- https://bugzilla.redhat.com/show_bug.cgi?id=961981
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=707776
- http://ubuntu.com/usn/usn-1842-1
- http://www.openwall.com/lists/oss-security/2013/05/10/4
- http://www.osvdb.org/93244
- http://xorl.wordpress.com/2013/05/22/cve-2013-2074-kde-kdelibs-password-exposure/
- collector/nvd-index
- agent/type
- agent/softwarecombine
- agent/first-publish-date
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/references
- agent/weakness
- agent/author
- agent/severity
- agent/event
- agent/tags
- agent/description
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2013-2074
- vendor/kde
- canonical/kde kdelibs
- version/kde kdelibs/4.10.3
- version/kde kdelibs/4.10.0
- version/kde kdelibs/4.10.1
- version/kde kdelibs/4.10.2