oss-security - Re: CVE Request -- kdebase4 (konqueror) -- Incomplete SSL Certificate support in KDE4

Openwall Project		/home Owl JtR Pro crypt pam_passwdqc tcb phpass scanlogd popa3d msulogin / Linux BIND / advisories presentations / services donations / wordlists passwords / NEWS community lists Wiki CVSweb mirrors signatures
bringing security into open environments

Password Recovery Resources on the Net

[<prev] [next>] [<thread-prev] [month] [year] [list]

Date: Thu, 21 May 2009 18:13:12 -0400 (EDT)
From: "Steven M. Christey" <coley@...us.mitre.org>
To: oss-security@...ts.openwall.com
Subject: Re: CVE Request -- kdebase4 (konqueror) -- Incomplete
 SSL Certificate support in KDE4

In CVE, we treat the inadvertent prevention of access to security
functionality as a bug.  There is no direct way that an external attacker
can trigger it, and the attacker gets no direct benefit by waiting for it
to happen passively.  It's only doable by a person doing this to
himself/herself.

So, this would not get a CVE.

- Steve

On Tue, 12 May 2009, Jan Lieskovsky wrote:

> Hello Steve,
>
>   not sure if original Debian bug [1] reporter meant this insufficiency,
> but [2] might be interesting for your attention. While this is not
> direct security vulnerability, is is preventing users from using
> the functionality provided by digital certificates.
>
> References:
> [1] http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=526979
> [2] https://bugs.kde.org/show_bug.cgi?id=185288
> [3] https://bugzilla.redhat.com/show_bug.cgi?id=500373
>
> This issue is present only in Konqueror web browser, as shipped
> with the K Desktop Environment 4 (kdebase-4.*). Konqueror in
> kdebase3 works fine.
>
> Regards, Jan.
> --
> Jan iankko Lieskovsky / Red Hat Security Response Team
>
>

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.