|| ||Dirk Mueller <email@example.com>|
|| ||firstname.lastname@example.org, email@example.com|
|| ||KDE Security Advisory: Secure Cookie Vulnerability|
|| ||Wed, 11 Sep 2002 01:11:03 +0200|
-----BEGIN PGP SIGNED MESSAGE-----
KDE Security Advisory: Secure Cookie Vulnerability
Original Release Date: 2002-09-08
1. Systems affected:
Konqueror in KDE 3.0, KDE 3.0.1 and KDE 3.0.2.
KDE 2.2.2 and KDE 3.0.3 are NOT affected.
Konqueror fails to detect the "secure" flag in HTTP cookies and as
a result may send secure cookies back to the originating site over
an unencrypted network connection.
A secure session that relies solely on secure cookies for
identifying the session can possibly be hijacked, or an account
which relies solely on secure cookies for logging on may be
compromised, by an attacker who manages to eavesdrop on the
unencrypted network connection.
Upgrade to KDE 3.0.3 in which this problem is fixed or apply the
A patch for KDE 3.0, KDE 3.0.1 and KDE 3.0.2 is available from
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.7 (GNU/Linux)
-----END PGP SIGNATURE-----
to post comments)