Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2004-1145

Multiple vulnerabilities in Konqueror in KDE 3.3.1 and earlier (1) allow access to restricted Java classes via JavaScript and (2) do not properly restrict access to certain Java classes from the Java applet, which allows remote attackers to bypass sandbox restrictions and read or write arbitrary files.

Published

2004-12-15T05:00:00.000

Last Modified

2025-04-03T01:03:51.193

Status

Deferred

Source

[email protected]

Severity

CVSSv2: 5.0 (MEDIUM)

CVSSv2 Vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Access Vector: NETWORK
Access Complexity: LOW
Authentication: NONE
Confidentiality Impact: NONE
Integrity Impact: PARTIAL
Availability Impact: NONE

Exploitability Score

10.0

Impact Score

2.9

Weaknesses

Type: Primary
NVD-CWE-Other

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	ethereal_group	ethereal	0.9	Yes
Application	ethereal_group	ethereal	0.9.1	Yes
Application	ethereal_group	ethereal	0.9.2	Yes
Application	ethereal_group	ethereal	0.9.3	Yes
Application	ethereal_group	ethereal	0.9.4	Yes
Application	ethereal_group	ethereal	0.9.5	Yes
Application	ethereal_group	ethereal	0.9.6	Yes
Application	ethereal_group	ethereal	0.9.7	Yes
Application	ethereal_group	ethereal	0.9.8	Yes
Application	ethereal_group	ethereal	0.9.9	Yes
Application	ethereal_group	ethereal	0.9.10	Yes
Application	ethereal_group	ethereal	0.9.11	Yes
Application	ethereal_group	ethereal	0.9.12	Yes
Application	ethereal_group	ethereal	0.9.13	Yes
Application	ethereal_group	ethereal	0.9.14	Yes
Application	ethereal_group	ethereal	0.9.15	Yes
Application	ethereal_group	ethereal	0.9.16	Yes
Application	ethereal_group	ethereal	0.10	Yes
Application	ethereal_group	ethereal	0.10.1	Yes
Application	ethereal_group	ethereal	0.10.2	Yes
Application	ethereal_group	ethereal	0.10.3	Yes
Application	ethereal_group	ethereal	0.10.4	Yes
Application	ethereal_group	ethereal	0.10.5	Yes
Application	ethereal_group	ethereal	0.10.6	Yes
Application	ethereal_group	ethereal	0.10.7	Yes
Application	sgi	propack	3.0	Yes
Operating System	conectiva	linux	9.0	Yes
Operating System	conectiva	linux	10.0	Yes
Operating System	altlinux	alt_linux	2.3	Yes
Operating System	altlinux	alt_linux	2.3	Yes
Operating System	debian	debian_linux	3.0	Yes
Operating System	debian	debian_linux	3.0	Yes
Operating System	debian	debian_linux	3.0	Yes
Operating System	debian	debian_linux	3.0	Yes
Operating System	debian	debian_linux	3.0	Yes
Operating System	debian	debian_linux	3.0	Yes
Operating System	debian	debian_linux	3.0	Yes
Operating System	debian	debian_linux	3.0	Yes
Operating System	debian	debian_linux	3.0	Yes
Operating System	debian	debian_linux	3.0	Yes
Operating System	debian	debian_linux	3.0	Yes
Operating System	redhat	enterprise_linux	2.1	Yes
Operating System	redhat	enterprise_linux	2.1	Yes
Operating System	redhat	enterprise_linux	2.1	Yes
Operating System	redhat	enterprise_linux	2.1	Yes
Operating System	redhat	enterprise_linux	2.1	Yes
Operating System	redhat	enterprise_linux	2.1	Yes
Operating System	redhat	enterprise_linux	3.0	Yes
Operating System	redhat	enterprise_linux	3.0	Yes
Operating System	redhat	enterprise_linux	3.0	Yes
Operating System	redhat	enterprise_linux_desktop	3.0	Yes
Operating System	redhat	linux_advanced_workstation	2.1	Yes
Operating System	redhat	linux_advanced_workstation	2.1	Yes
Operating System	suse	suse_linux	8.0	Yes
Operating System	suse	suse_linux	8.0	Yes
Operating System	suse	suse_linux	8.1	Yes
Operating System	suse	suse_linux	8.2	Yes
Operating System	suse	suse_linux	9.0	Yes
Operating System	suse	suse_linux	9.0	Yes
Operating System	suse	suse_linux	9.1	Yes
Operating System	suse	suse_linux	9.2	Yes

References

http://marc.info/?l=bugtraq&m=110356286722875&w=2 ([email protected])
http://secunia.com/advisories/13586 Patch, Vendor Advisory ([email protected])
http://www.gentoo.org/security/en/glsa/glsa-200501-16.xml Patch, Vendor Advisory ([email protected])
http://www.heise.de/security/dienste/browsercheck/tests/java.shtml Vendor Advisory ([email protected])
http://www.kb.cert.org/vuls/id/420222 Patch, Third Party Advisory, US Government Resource ([email protected])
http://www.kde.org/info/security/advisory-20041220-1.txt Patch, Vendor Advisory ([email protected])
http://www.mandriva.com/security/advisories?name=MDKSA-2004:154 ([email protected])
http://www.redhat.com/support/errata/RHSA-2005-065.html Patch, Vendor Advisory ([email protected])
https://exchange.xforce.ibmcloud.com/vulnerabilities/18596 ([email protected])
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10173 ([email protected])
http://marc.info/?l=bugtraq&m=110356286722875&w=2 (af854a3a-2127-422b-91ae-364da2661108)
http://secunia.com/advisories/13586 Patch, Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://www.gentoo.org/security/en/glsa/glsa-200501-16.xml Patch, Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://www.heise.de/security/dienste/browsercheck/tests/java.shtml Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://www.kb.cert.org/vuls/id/420222 Patch, Third Party Advisory, US Government Resource (af854a3a-2127-422b-91ae-364da2661108)
http://www.kde.org/info/security/advisory-20041220-1.txt Patch, Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://www.mandriva.com/security/advisories?name=MDKSA-2004:154 (af854a3a-2127-422b-91ae-364da2661108)
http://www.redhat.com/support/errata/RHSA-2005-065.html Patch, Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://exchange.xforce.ibmcloud.com/vulnerabilities/18596 (af854a3a-2127-422b-91ae-364da2661108)
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10173 (af854a3a-2127-422b-91ae-364da2661108)