lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Mon, 06 Aug 2007 23:44:15 +0200
From: Robert Swiecki <jagger@...ecki.net>
To: bugtraq@...urityfocus.com, full-disclosure@...ts.grok.org.uk
Subject: Konqueror: URL address bar spoofing vulnerabilities


There are vulnerabilities in Konqueror that allow an attacker to
spoof the URL adddress bar.

The first example uses setInterval() call with relatively small interval
value (e.g. 0) to change window.location property. A browser is
entrapped within the attacking web site while the user thinks that
browser actually left the page.

http://alt.swiecki.net/konq2.html

The very similar problem affects Apple Safari (3.0.3) but due to
recent changes in Safari code (vide
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-2398 ) it's a lot harder to
conduct a successful attack - URL address bat content changes so
frequently so the attack is revealed to the user (variants of attack are
currently under investigation).

The second one is based on the http URI scheme which allows embedding
user/password parameters into it, i.e. http://user:password@...ain.com.
Such parameters can contain whitespaces, so the attack vector is quite
obvious.

http://alt.swiecki.net/konq3.html

Tested with Konqueror 3.5.7 on Linux 2.6

The snapshot from my dekstop:
http://alt.swiecki.net/konq3.png

-- 
Robert Swiecki

Powered by blists - more mailing lists