KDE May Disclose SMB Passwords to Remote Users Via URLs
Categorie: Vulnerability Posted: 2004-12-11 by ReCall Views: 408 Source: Click here
Current Rating: Not rated
Details
Description: A vulnerability was reported in KDE. Passwords may be disclosed via URLs.
The vendor reported that when a user creates a link to a remote file using various KDE applications, the resulting link may include authentication credentials for the remote system. This may include Samba passwords for files located on SMB servers.
The password for SMB protocol URLs is always addded in plaintext to the URL in the link reference file ('*.desktop' file).
Daniel Fabian is credited with reporting this flaw.
