Title: KDE Konqueror Sub-Frames Script Execution Vulnerability
Severity: HIGH
Description:
When a browser window opens another window, security checks should prevent the parent from accessing the child if the latter is of another domain.
It has been reported that Konqeuror does not properly set the domain of sub-frames or sub-iframes correctly. It is possible for a parent window to set the URL of frames or iframes within a child window regardless of the domain. This has serious security implications as the parent can cause script code to be executed within the context of the child domain.
This may enable a maliciously constructed webpage to cause script code to be executed in the context of an arbitrary website in an another unassociated domain, making the browser prone to cross-site scripting attacks.
Other software that uses the KHTML interpreter is also prone to this issue.
Affected Products:
- Caldera OpenLinux Server 3.1.0
- Caldera OpenLinux Server 3.1.1
- Caldera OpenLinux Workstation 3.1.0
- Caldera OpenLinux Workstation 3.1.1
- Conectiva Linux 8.0.0
- Conectiva Linux Enterprise Edition 1.0.0
- Debian Linux 2.2.0
- Debian Linux 2.2.0 68k
- Debian Linux 2.2.0 IA-32
- Debian Linux 2.2.0 alpha
- Debian Linux 2.2.0 arm
- Debian Linux 2.2.0 powerpc
- Debian Linux 2.2.0 sparc
- Debian Linux 3.0.0
- Debian Linux 3.0.0 alpha
- Debian Linux 3.0.0 arm
- Debian Linux 3.0.0 hppa
- Debian Linux 3.0.0 ia-32
- Debian Linux 3.0.0 ia-64
- Debian Linux 3.0.0 m68k
- Debian Linux 3.0.0 mips
- Debian Linux 3.0.0 mipsel
- Debian Linux 3.0.0 ppc
- Debian Linux 3.0.0 s/390
- Debian Linux 3.0.0 sparc
- FreeBSD FreeBSD 4.7.0 -STABLE
- KDE KDE 2.2.1
- KDE KDE 2.2.2
- KDE KDE 3.0.0
- KDE KDE 3.0.1
- KDE KDE 3.0.2
- KDE KDE 3.0.3
- KDE Konqueror 2.2.2
- KDE Konqueror 3.0.0
- KDE Konqueror 3.0.1
- KDE Konqueror 3.0.2
- KDE Konqueror 3.0.3
- MandrakeSoft Linux Mandrake 8.1.0
- MandrakeSoft Linux Mandrake 8.1.0 ia64
- MandrakeSoft Linux Mandrake 8.2.0
- MandrakeSoft Linux Mandrake 8.2.0 ppc
- MandrakeSoft Linux Mandrake 9.0.0
- RedHat Advanced Workstation for the Itanium Processor 2.1.0
- RedHat Enterprise Linux AS 2.1
- RedHat Enterprise Linux AS 2.1 IA64
- RedHat Enterprise Linux ES 2.1
- RedHat Enterprise Linux ES 2.1 IA64
- RedHat Enterprise Linux WS 2.1
- RedHat Enterprise Linux WS 2.1 IA64
- RedHat Linux 7.1.0 i386
- RedHat Linux 7.2.0 i386
- RedHat Linux 7.2.0 ia64
- RedHat Linux Advanced Work Station 2.1.0
- Sun Linux 5.0.5
- Sun Linux 5.0.6
- Sun Linux 5.0.7
- Turbolinux Turbolinux Server 7.0.0
- Turbolinux Turbolinux Server 8.0.0
- Turbolinux Turbolinux Workstation 7.0.0
- Turbolinux Turbolinux Workstation 8.0.0
Juniper Networks provides this content via a wide variety of sources and production methods. If notified of errors or omissions in the content of this page, Juniper Networks, at its discretion, will modify or remove the page or leave the content as is, depending on various factors including but not limited to the reputation and authority of the party providing the notification. Please use the contact information displayed elsewhere on this page to report any errors or omissions regarding the content on this page.
