Apple Safari and Konqueror Embedded Common Name Verification Vulnerability - Advisories

Software Inspectors

	Scan Online

	Personal (PSI)

	Network (NSI 2.0)

Solutions For

	Security Professionals

	Security Vendors

Free Solutions For

	Open Communities

	Journalists & Media

Secunia Advisories

	Search

	Historic Advisories

	Listed By Product

	Listed By Vendor

	Statistics / Graphs

	Secunia Research

	Report Vulnerability

	About Advisories

Virus Information

	Chronological List

	Last 10 Virus Alerts

	About Virus Information

Secunia Customers

	Customer Area

Apple Safari and Konqueror Embedded Common Name Verification Vulnerability

Secunia Advisory:	SA8756
Release Date:	2003-05-09
Last Update:	2003-06-18

Critical:	Moderately critical
Impact:	Spoofing
Where:	From remote
Solution Status:	Vendor Patch

OS:	Apple Macintosh OS X

Software:	KDE 2.x Konqueror Embedded Safari 1.x

CVE reference:	CVE-2003-0355 (Secunia mirror) CVE-2003-0370 (Secunia mirror)

	Want to know the next time vulnerabilities are fixed in this product? - Companies can be alerted via email and SMS!

Description: Apple Safari and Konqueror Embedded fails to validate the Common Name of a SSL certificate. This makes it possible to spoof SSL sites, so that users can't trust the authenticity of a SSL website. SSL serves two main purposes; one is to ensure the authenticity of the server, which you are communicating with, the other is to provide encrypted communication. The authenticity part is completely broken when the Common Name isn't verified, since the user can't know if he is communicating with the host in the address bar. Exploitation of this requires that a malicious person is able to perform DNS spoofing (eg. see CERT vulnerability note in "Other References" section). Internet Explorer and Netscape suffered similar vulnerabilities a few years ago. Solution: KDE advises users of KDE 2.2.2 to upgrade to either KDE 3.0.5a or KDE 3.1.2. A patch for version 2.2.2 has also been made available: ftp://ftp.kde.org/pub/kde/security_patches/post-2.2.2-kdelibs-kssl-2.diff ftp://ftp.kde.org/pub/kde/security_patches/post-2.2.2-kdelibs-kio-2.diff Update Konqueror/Embedded to the snapshot of May 16, 2003 or later: http://devel-home.kde.org/~hausmann/s...ror-embedded-snapshot-20030516.tar.gz Apple has released a new version of Safari which isn't vulnerable. http://www.apple.com/safari/ Provided and/or discovered by: Simson L. Garfinkel and Jesse Burns Changelog: 2003-06-02: KDE releases advisory and updated versions. 2003-06-10: Apple has released new version of safari. Original Advisory: http://www.kde.org/info/security/advisory-20030602-1.txt Other References: DNS Spoofing: http://www.kb.cert.org/vuls/id/457875



Please note: The information that this Secunia Advisory is based on comes from a third party unless stated otherwise. Secunia collects, validates, and verifies all vulnerability reports issued by security research groups, vendors, and others.

146 Related Secunia Security Advisories, displaying 10

1. Mozilla Firefox 3 on Mac OS X GIF File Handling Code Execution

2. Apple Mac OS X Security Update Fixes Multiple Vulnerabilities

3. Apple Mac OS X ARDAgent Privilege Escalation Vulnerability

4. Apple Mac OS X Security Update Fixes Multiple Vulnerabilities

5. Apple iCal Memory Corruption Vulnerability

6. Mac OS X Security Update Fixes Multiple Vulnerabilities

7. Apple Mac OS X "ipcomp6_input()" Denial of Service

8. Apple Mac OS X Security Update Fixes Multiple Vulnerabilities

9. Apple Mac OS X Security Update Fixes Multiple Vulnerabilities

10. Mac OS X Java Multiple Vulnerabilities

Show all related advisories

Send Feedback to Secunia

If you have new information regarding this Secunia advisory or a product in our database, please send it to us using either our web form or email us at vuln@secunia.com. Ideas, suggestions, and other feedback are most welcome.

Secunia PSI
Scan | Patch | Track
Free Download

Secunia Poll

Most Popular Advisories

1.	Linux Kernel LDT Buffer Size Handling Vulnerability

2.	OpenBSD BIND Query Port DNS Cache Poisoning

3.	Drupal Session Fixation Vulnerability

4.	Red Hat update for thunderbird

5.	Apple Safari Cross-Domain Cookie Injection Vulnerability

6.	IPCop update for perl

7.	Slackware update for dnsmasq

8.	Red Hat update for kernel

9.	Ubuntu update for php

10.	dnsmasq Denial of Service and DNS Cache Poisoning