Description
The FTP protocol implementation in Konqueror 3.5.5 allows remote servers to force the client to connect to other servers, perform a proxied port scan, or obtain sensitive information by specifying an alternate server address in an FTP PASV response.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
n/a n/a
n/aaffected
References
- http://www.redhat.com/support/errata/RHSA-2007-0909.html ↗
- https://issues.rpath.com/browse/RPL-1201 ↗
- http://secunia.com/advisories/24889 ↗
- http://www.ubuntu.com/usn/usn-447-1 ↗
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10646 ↗
- http://www.novell.com/linux/security/advisories/2007_6_sr.html ↗
- http://bindshell.net/papers/ftppasv/ftp-client-pasv-manipulation.pdf ↗
- http://www.kde.org/info/security/advisory-20070326-1.txt ↗
- http://secunia.com/advisories/27108 ↗
- http://securitytracker.com/id?1017801 ↗
- http://www.securityfocus.com/bid/23091 ↗
- http://www.vupen.com/english/advisories/2007/1076 ↗
- http://www.mandriva.com/security/advisories?name=MDKSA-2007:072 ↗