Bug#294204: konqueror: IDN URL Spoofing

["Colin S. Miller" <csmiller@iname.com>]

Package: konqueror
Version: 4:3.3.2-1
Severity: normal

http://www.shmoo.com/idn/ shows a proof-of-concept attack
against konqueror amongst other browsers (konqueror isn't
explicatly listed as vulnable).

The basic attack is using homographs in URLs
(two characters from different Unicode pages which
look different but are for different roles).

The upstream authors are marking this as 'wish-list',
but other browsers are handling this as serious.

They are also indicating that this may be
reassigned to kde-core, please reassign here if
required.

Colin S. Miller


-- System Information:
Debian Release: 3.1
  APT prefers testing
  APT policy: (500, 'testing')
Architecture: i386 (i686)
Kernel: Linux 2.6.7-1-386
Locale: LANG=en_GB, LC_CTYPE=en_GB (charmap=ISO-8859-1)

Versions of packages konqueror depends on:
ii  kcontrol                 4:3.3.2-1       KDE Control Center
ii  kdebase-kio-plugins      4:3.3.2-1       KDE I/O Slaves
ii  kdelibs4                 4:3.3.2-1       KDE core libraries
ii  kdesktop                 4:3.3.2-1       KDE Desktop
ii  kfind                    4:3.3.2-1       KDE File Find Utility
ii  libart-2.0-2             2.3.16-6        Library of functions for 2D graphi
ii  libc6                    2.3.2.ds1-20    GNU C Library: Shared libraries an
ii  libfam0c102              2.7.0-6         client library to control the FAM 
ii  libgcc1                  1:3.4.3-6       GCC support library
ii  libice6                  4.3.0.dfsg.1-10 Inter-Client Exchange library
ii  libidn11                 0.5.2-3         GNU libidn library, implementation
ii  libjpeg62                6b-9            The Independent JPEG Group's JPEG 
ii  libkonq4                 4:3.3.2-1       Core libraries for KDE's file mana
ii  libpcre3                 4.5-1.1         Perl 5 Compatible Regular Expressi
ii  libpng12-0               1.2.8rel-1      PNG library - runtime
ii  libqt3c102-mt            3:3.3.3-8       Qt GUI Library (Threaded runtime v
ii  libsm6                   4.3.0.dfsg.1-10 X Window System Session Management
ii  libstdc++5               1:3.3.5-5       The GNU Standard C++ Library v3
ii  libx11-6                 4.3.0.dfsg.1-10 X Window System protocol client li
ii  libxext6                 4.3.0.dfsg.1-10 X Window System miscellaneous exte
ii  libxrender1              0.8.3-7         X Rendering Extension client libra
ii  xlibs                    4.3.0.dfsg.1-10 X Keyboard Extension (XKB) configu
ii  zlib1g                   1:1.2.2-3       compression library - runtime

-- no debconf information