Two flaws in the Konqueror web browser make it possible to by pass the sandbox environment which is used to run Java-applets. One flaw allows access to restricted Java classes via JavaScript, making it possible to escalate the privileges of the Java-applet. The other problem is that Konqueror fails to correctly restrict access to certain Java classes from the Java-applet itself.
Impact:
When a user has Java enabled in Konqueror and visits a malicious website, the website can run a Java-applet and obtain escalated privileges allowing reading and writing of arbitrary files with the privileges of the user.
Solution:
Upgrade to KDE 3.3.2
A backport has been made available for older versions which fixes this vulnerability. Contact your OS vendor / binary package provider for information about how to obtain updated binary packages.
Time line and credits:
24/11/2004 security@kde.org contacted by heise Security
29/11/2004 Fixed in KDE CVS by Koos Vriezen
14/12/2004 Backport for KDE 3.2.3
20/12/2004 KDE Advisory released
