NVD

Id
70858  
Name
CVE-2004-0411  
Description
The URI handlers in Konqueror for KDE 3.2.2 and earlier do not properly filter "-" characters that begin a hostname in a (1) telnet, (2) rlogin, (3) ssh, or (4) mailto URI, which allows remote attackers to manipulate the options that are passed to the associated programs, possibly to read arbitrary files or execute arbitrary code.  
Reject
 
CVSS Version
2  
CVSS Score
7.5  
Severity
High  
CVSS Base Score
7.5  
CVSS Impact Subscore
6.4  
CVSS Exploit Subscore
10  
CVSS Vector
(AV:N/AC:L/Au:N/C:P/I:P/A:P)  
Pub Date
2017-07-18  
Published
2004-07-07  
Modified Date
2017-07-10  
Seq
2004-0411  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
365538 70858 CVE-2004-0411 CLA-2004:843  View
365539 70858 CVE-2004-0411 20040517 KDE Security Advisory: URI Handler Vulnerabilities  View
365540 70858 CVE-2004-0411 oval:org.mitre.oval:def:954  View
365541 70858 CVE-2004-0411 GLSA-200405-11  View
365542 70858 CVE-2004-0411 O-146  View
365543 70858 CVE-2004-0411 DSA-518  View
365544 70858 CVE-2004-0411 http://www.kde.org/info/security/advisory-20040517-1.txt  View
365545 70858 CVE-2004-0411 SuSE-SA:2003:014  View
365546 70858 CVE-2004-0411 RHSA-2004:222  View
365547 70858 CVE-2004-0411 FEDORA-2004-121  View
365548 70858 CVE-2004-0411 FEDORA-2004-122  View
365549 70858 CVE-2004-0411 20040513 Opera Telnet URI Handler Vulnerability also applies to other browsers  View
365550 70858 CVE-2004-0411 10358  View
365551 70858 CVE-2004-0411 SSA:2004-238  View
365552 70858 CVE-2004-0411 kde-url-handler-gain-access(16163)  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
62856 JVNDB-2004-000198 kdelibs の複数の URI ハンドラにおける任意のコードを実行される脆弱性 kdelibs に含まれる、telnet、rlogin、ssh、および mailto の URI ハンドラでは、引数の妥当性の確認が不適切であるため、ホスト名の先頭に「-」がつけられている場合、URI ハンドラが開始するプログラムの起動オプションとして解釈されてしまう脆弱性が存在します。 CVE-2004-0411 8838 CVE-2004-0411 70858 7.5 http://jvndb.jvn.jp/ja/contents/2004/JVNDB-2004-000198.html 2004-05-17 2007-04-01 View