Unscored severity · published Jan 10, 2005
CVE-2004-1171
KDE 3.2.x and 3.3.0 through 3.3.2, when saving credentials that are (1) manually entered by the user or (2) created by the SMB protocol handler, stores those credentials for…
–
CVSS
0.4%
EPSS
No
On KEV
Description
KDE 3.2.x and 3.3.0 through 3.3.2, when saving credentials that are (1) manually entered by the user or (2) created by the SMB protocol handler, stores those credentials for plaintext in the user's .desktop file, which may be created with world-readable permissions, which could allow local users to obtain usernames and passwords for remote resources such as SMB shares.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 39% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FC
Fedora Core · Redhat
core_2.0; core_3.0 · source: NVD
KD
Kde · Kde
3.2; 3.2.1; 3.2.2; 3.2.3; 3.3; 3.3.1; +1 more · source: NVD
ML
Mandrake Linux · Mandrakesoft
10.0; 10.0; 10.1; 10.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2004-1171
CVE.org
https://www.cve.org/CVERecord?id=CVE-2004-1171
archives.neohapsis.com
http://archives.neohapsis.com/archives/fulldisclosure/2004-11/1292.html
marc.info
http://marc.info/?l=bugtraq&m=110178786809694&w=2
marc.info
http://marc.info/?l=bugtraq&m=110261063201488&w=2
secunia.com
http://secunia.com/advisories/13477
secunia.com
http://secunia.com/advisories/13486
secunia.com
http://secunia.com/advisories/13560
More from Kde
8.8
CVE-2012-4512
The CSS parser (khtml/css/cssparser.cpp) in Konqueror in KDE 4.7.3 allows remote attackers to cause a denial of service (crash) and possibly read memory via a crafted font face…
7.5
CVE-2005-1920
The (1) Kate and (2) Kwrite applications in KDE KDE 3.2.x through 3.4.0 do not properly set the same permissions on the backup file as were set on the original file, which could…
7.1
CVE-2004-0689
KDE before 3.3.0 does not properly handle when certain symbolic links point to "stale" locations, which could allow local users to create or truncate arbitrary files
–
CVE-2012-4515
Use-after-free vulnerability in khtml/rendering/render_replaced.cpp in Konqueror in KDE 4.7.3, when the context menu is shown, allows remote attackers to cause a denial of service…
–
CVE-2012-4514
rendering/render_replaced.cpp in Konqueror in KDE before 4.9.3 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted web page, related to…