CVE-2004-1145 Security feature bypass in n/a
Remote attackers can bypass Java sandbox restrictions in Konqueror to read or write arbitrary files via malicious JavaScript or applets.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2004-1145?
CVE-2004-1145 is a medium-severity vulnerability in Conectiva Linux, published on 31 Dec 2004. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Multiple vulnerabilities in Konqueror in KDE 3.3.1 and earlier (1) allow access to restricted Java classes via JavaScript and (2) do not properly restrict access to certain Java classes from the Java applet, which allows remote attackers to bypass sandbox restrictions and read or write arbitrary files.
Which versions are affected by CVE-2004-1145?
It affects 9 products.
Products include Altlinux Alt Linux, Conectiva Linux, Debian Debian Linux, Ethereal Group Ethereal, Redhat Enterprise Linux, Redhat Enterprise Linux Desktop and 3 more.
How do I fix CVE-2004-1145?
Upgrade to a fixed version.
Is CVE-2004-1145 being exploited?
There is no known exploitation of CVE-2004-1145 in the wild and no public exploit code.
Other vulnerabilities in Conectiva Linux
Sources
Also known as GHSA-95hh-399q-cvw3.