FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

CVE-2004-1158

This CVE name corresponds to:

Entered	Topic
2005-01-24	web browsers -- window injection vulnerabilities

The following information is adapted from the Common Vulnerabilities and Exposures (CVE) project. CVE and the CVE logo are trademarks of The MITRE Corporation. CVE content is Copyright 2005, The MITRE Corporation.

CVE-2004-1158 at cve.mitre.org

Details

Type	Candidate
Name	CVE-2004-1158
Phase	Assigned(20041208)

Description

Konqueror 3.x up to 3.2.2-6, and possibly other versions, allows remote attackers to spoof arbitrary web sites by injecting content from one window into a target window or tab whose name is known but resides in a different domain, as demonstrated using a pop-up window on a trusted web site, aka the "window injection" vulnerability.

References

Source	Reference
MISC	http://secunia.com/secunia_research/2004-13/advisory/
MISC	http://secunia.com/multiple_browsers_window_injection_vulnerability_test/
SUSE	SUSE-SR:2005:001
OVAL	oval:org.mitre.oval:def:11056
SECUNIA	13254
BUGTRAQ	20041213 KDE Security Advisory: Konqueror Window Injection Vulnerability
CONFIRM	http://www.kde.org/info/security/advisory-20041213-1.txt
REDHAT	RHSA-2005:009
BID	11853
SECUNIA	13254
SECUNIA	13560
SECUNIA	13477
SECUNIA	13486