Secunia

Albert Puigsech Galicia has reported a vulnerability in Konqueror, which can be exploited by malicious people to conduct FTP command injection attacks.

The vulnerability is caused due to insufficient input validation of FTP URIs. This can be exploited by e.g. a malicious website to inject arbitrary FTP commands in a FTP session using a specially crafted pathname or username containing "%0A" and "%0D" characters.

This can further be exploited to relay mails if the URL references port 25.

The vulnerability affects version 3.3.2 and prior.

Solution
Apply patch.
Further details available in Customer Area

Provided and/or discovered by
Albert Puigsech Galicia

Changelog
Further details available in Customer Area

Original Advisory
KDE:
http://www.kde.org/info/security/advisory-20050101-1.txt

Albert Puigsech Galicia:
http://www.7a69ezine.org/node/view/169

Deep Links
Links available in Customer Area