Multiple KDE Security Advisories (2005-03-16)

[Waldo Bastian <bastian () kde org>]

Three KDE security advisories have been issued today.

KDE Security Advisory: Local DCOP denial of service vulnerability
Original Release Date: 20050316
URL: http://www.kde.org/info/security/advisory-20050316-1.txt

0. References
        http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0396


1. Systems affected:

        All KDE version prior to KDE 3.4 on systems where multiple users
        have access.


2. Overview:

        Sebastian Krahmer of the SUSE LINUX Security Team reported a local
        denial of service vulnerability in KDE's Desktop Communication
        Protocol (DCOP) daemon better known as dcopserver.

        A local user can lock up the dcopserver of arbitrary other users
        on the same machine by stalling the DCOP authentication process.

        Although it is not possible to by pass the authentication process
        this way, it can cause a significant reduction in desktop
        functionality for the affected users.

        The Common Vulnerabilities and Exposures project (cve.mitre.org)
        has assigned the name CAN-2005-0396 to this issue.

      
3. Impact:

        A local user can lock up the dcopserver of arbitrary other users
        on the same machine. This can cause a significant reduction in
        desktop functionality for the affected users including, but not
        limited to, the inability to browse the internet and the inability
        to start new applications.


4. Solution:

        Upgrade to KDE 3.4.

        For older versions of KDE Source code patches have been made
        available which fix these vulnerabilities. Contact your OS vendor /
        binary package provider for information about how to obtain updated
        binary packages.


5. Patch:

        A patch for KDE 3.1.x is available from
        ftp://ftp.kde.org/pub/kde/security_patches

        377c49d8224612fbf09f70f3c09d52f5  post-3.1.5-kdelibs-dcop.patch

        A patch for KDE 3.2.x is available from
        ftp://ftp.kde.org/pub/kde/security_patches

        0948701bffb082c65784dc8a2b648ef0  post-3.2.3-kdelibs-dcop.patch

        A patch for KDE 3.3.x is available from
        ftp://ftp.kde.org/pub/kde/security_patches

        7309e259ae1f29be08bbb70e580da3fb  post-3.3.2-kdelibs-dcop.patch


6. Time line and credits:

        21/02/2005 KDE Security informed by SUSE LINUX.
        21/02/2005 Patches applied to KDE CVS.
        02/03/2005 Vendors notified
        16/03/2005 KDE Security Advisory released.


KDE Security Advisory: Konqueror International Domain Name Spoofing
Original Release Date: 20050316
URL: http://www.kde.org/info/security/advisory-20050316-2.txt

0. References
        http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0237
        http://bugs.kde.org/show_bug.cgi?id=98788
   http://lists.netsys.com/pipermail/full-disclosure/2005-February/031459.html 
   http://lists.netsys.com/pipermail/full-disclosure/2005-February/031460.html 
        http://www.shmoo.com/idn 
        http://www.shmoo.com/idn/homograph.txt 
        http://xforce.iss.net/xforce/xfdb/19236
        http://secunia.com/advisories/14162/

1. Systems affected:

        All KDE versions in the KDE 3.2.x and KDE 3.3.x series.


2. Overview:

        Since version 3.2 KDE and it's webbrowser Konqueror have support
        for International Domain Names (IDN). Unfortunately this has
        made KDE vulnerable to a phishing technique known as a 
        Homograph attack.

        IDN allows a website to use a wide range of international characters
        in its domain name. Unfortunately some of these characters have a
        strong resemblance to other characters, so called homographs. This
        makes it possible for a website to use a domain name that is
        technically different from another well known domain name, but has
        no or very little visual differences.

        This lack of visual difference can be abused by attackers to
        trick users into visiting malicious websites that resemble
        a well known and trusted website in order to obtain personal
        information such as credit card details.

        The Common Vulnerabilities and Exposures project (cve.mitre.org)
        has assigned the name CAN-2005-0237 to this issue.

        For KDE 3.4 KDE and the Konqueror webbrowser have adopted a
        whitelist of domains for which IDN is safe to use because the
        registrar for these domains has implemented anti-homographic
        character policies or otherwise limited the available set of
        characters to prevent spoofing.

      
3. Impact:

        Users can be tricked into visiting a malicious website that
        resembles a well known and trusted website without getting any
        visual indication that this website differs from the one the
        user was expecting to visit.


4. Solution:

        Upgrade to KDE 3.4.

        For older versions of KDE Source code patches have been made
        available which fix these vulnerabilities. Contact your OS vendor /
        binary package provider for information about how to obtain updated
        binary packages.


5. Patch:

        A patch for KDE 3.2.x is available from
        ftp://ftp.kde.org/pub/kde/security_patches

        611bad3cb9ae46ac35b907c7321da7aa  post-3.2.3-kdelibs-idn.patch

        A patch for KDE 3.3.x is available from
        ftp://ftp.kde.org/pub/kde/security_patches

        c87754dbbaca4cdfeb26626a908fab5f  post-3.3.2-kdelibs-idn.patch

6. Time line and credits:

        07/02/2005 Issue raised by Eric Johanson on full-disclosure
        03/03/2005 Patches applied to KDE CVS.
        04/03/2005 Vendors notified
        16/03/2005 KDE Security Advisory released.


KDE Security Advisory: Insecure temporary file creation by dcopidlng
Original Release Date: 20050316
URL: http://www.kde.org/info/security/advisory-20050316-3.txt

0. References
        http://bugs.kde.org/show_bug.cgi?id=97608
        http://www.gentoo.org/security/en/glsa/glsa-200503-14.xml 
        http://bugs.gentoo.org/attachment.cgi?id=51120&action=view
        http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0365

1. Systems affected:

        All KDE versions in the KDE 3.2.x and KDE 3.3.x series.
        This problem only affects users who compile KDE or KDE applications
        themselves.

2. Overview:

        The dcopidlng script is vulnerable to symlink attacks, potentially
        allowing a local user to overwrite arbitrary files of a user when
        the script is run on behalf of that user.

        The dcopidlng script is run as part of the build process of KDE
        itself and may be used by the build process of third party KDE
        applications.

        The Common Vulnerabilities and Exposures project (cve.mitre.org)
        has assigned the name CAN-2005-0365 to this issue.

      
3. Impact:

        The dcopidlng script is vulnerable to symlink attacks, potentially
        allowing a local user to overwrite arbitrary files of a user when
        that user compiles KDE or third party KDE applications that use the
        dcopidlng script as part of their build process.


4. Solution:

        Upgrade to KDE 3.4.

        For older versions of KDE Source code patches have been made
        available which fix these vulnerabilities.

        Installed versions of dcopidlng can be patched manually as follows:

            cd $(kde-config --expandvars --install exe)
            patch < ~/post-3.2.3-kdelibs-dcopidlng.patch

5. Patch:

        A patch for KDE 3.2.x is available from
        ftp://ftp.kde.org/pub/kde/security_patches

        43213bb9876704041af622ed2a6903ae  post-3.2.3-kdelibs-dcopidlng.patch

        A patch for KDE 3.3.x is available from
        ftp://ftp.kde.org/pub/kde/security_patches

        43213bb9876704041af622ed2a6903ae  post-3.3.2-kdelibs-dcopidlng.patch


6. Time line and credits:

        21/01/2005 Problem reported to bugs.kde.org by Davide Madrisan
        21/01/2005 Patches applied to KDE CVS.
        16/03/2005 KDE Security Advisory released.

Attachment: _bin
Description: