CVE-2004-0411

Konqueror < 3.2.2 - Command Injection via URI Handler Hostname

Title source: llm
STIX 2.1

Description

The URI handlers in Konqueror for KDE 3.2.2 and earlier do not properly filter "-" characters that begin a hostname in a (1) telnet, (2) rlogin, (3) ssh, or (4) mailto URI, which allows remote attackers to manipulate the options that are passed to the associated programs, possibly to read arbitrary files or execute arbitrary code.

References (17)

Core 17
Core References
Broken Link vendor-advisory x_refsource_redhat
http://www.redhat.com/support/errata/RHSA-2004-222.html
Broken Link vendor-advisory x_refsource_suse
http://www.novell.com/linux/security/advisories/2004_14_kdelibs.html
Patch, Vendor Advisory x_refsource_confirm
http://www.kde.org/info/security/advisory-20040517-1.txt
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/16163
Broken Link, Third Party Advisory, VDB Entry vendor-advisory x_refsource_fedora
http://www.securityfocus.com/advisories/6717
Broken Link, Third Party Advisory, VDB Entry, Vendor Advisory mailing-list x_refsource_bugtraq
http://www.securityfocus.com/archive/1/363225
Third Party Advisory vendor-advisory x_refsource_debian
http://www.debian.org/security/2004/dsa-518
Broken Link, Third Party Advisory, VDB Entry vendor-advisory x_refsource_fedora
http://www.securityfocus.com/advisories/6743
Broken Link vdb-entry x_refsource_osvdb
http://www.osvdb.org/6107
Mailing List, Third Party Advisory mailing-list x_refsource_bugtraq
http://marc.info/?l=bugtraq&m=108481412427344&w=2
Broken Link third-party-advisory x_refsource_secunia
http://secunia.com/advisories/11602
Broken Link vendor-advisory x_refsource_conectiva
http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000843
Third Party Advisory vendor-advisory x_refsource_gentoo
http://security.gentoo.org/glsa/glsa-200405-11.xml
Broken Link, Tool Signature vdb-entry signature x_refsource_oval
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A954
Broken Link, Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/10358
Broken Link third-party-advisory government-resource x_refsource_ciac
http://www.ciac.org/ciac/bulletins/o-146.shtml

Scores

EPSS 0.0649
EPSS Percentile 91.2%

Details

CWE
CWE-88
Status published
Products (1)
kde/konqueror < 3.2.2
Published Jul 07, 2004
Tracked Since Feb 18, 2026