diff options
| author | Tobias C. Berner <tcberner@FreeBSD.org> | 2017-03-11 10:28:37 +0000 |
|---|---|---|
| committer | Tobias C. Berner <tcberner@FreeBSD.org> | 2017-03-11 10:28:37 +0000 |
| commit | a6e4c01e8257f2b63ea4b9ff90be9cd5e2302542 (patch) | |
| tree | 75be74dcbf792e1b4b72335f0e91f894f5a7ea23 /devel/kf5-kio/Makefile | |
| parent | 5fe248858cb99a2eae5e1a43bc939f4ca71773b4 (diff) | |
| download | ports-a6e4c01e8257f2b63ea4b9ff90be9cd5e2302542.tar.gz ports-a6e4c01e8257f2b63ea4b9ff90be9cd5e2302542.zip | |
Adress CVE-2017-6410 in devel/kf5-kio and x11/kdelibs4
Using a malicious PAC file, and then using exfiltration methods in the PAC
function FindProxyForURL() enables the attacker to expose full https URLs.
This is a security issue since https URLs may contain sensitive
information in the URL authentication part (user:password@host), and in the
path and the query (e.g. access tokens).
This attack can be carried out remotely (over the LAN) since proxy settings
allow ``Detect Proxy Configuration Automatically''
This setting uses WPAD to retrieve the PAC file, and an attacker who has access
to the victim's LAN can interfere with the WPAD protocols (DHCP/DNS+HTTP)
and inject his/her own malicious PAC instead of the legitimate one.
Reviewed by: mat, rakuco
Approved by: rakuco (mentor), mat (mentor)
Obtained from: https://marc.info/?l=kde-announce&m=148831226706885&w=2
MFH: 2017Q1
Security: CVE-2017-6410
Differential Revision: https://reviews.freebsd.org/D9908
Notes
Notes:
svn path=/head/; revision=435896
Diffstat (limited to 'devel/kf5-kio/Makefile')
| -rw-r--r-- | devel/kf5-kio/Makefile | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/devel/kf5-kio/Makefile b/devel/kf5-kio/Makefile index fe4383568c2a..b89feb9c3a90 100644 --- a/devel/kf5-kio/Makefile +++ b/devel/kf5-kio/Makefile @@ -3,6 +3,7 @@ PORTNAME= kio PORTVERSION= ${KDE_FRAMEWORKS_VERSION} +PORTREVISION= 1 CATEGORIES= devel kde kde-frameworks MAINTAINER= kde@FreeBSD.org |