|
|
|
|
| |
Credit:
The information has been provided by Dirk Mueller.
The original article can be found at: http://www.kde.org/info/security/advisory-20060614-1.txt
|
| |
Vulnerable Systems:
* KDE version 3.2.0 and above
* KDE version 3.5.3 and prior
By using a symlink attack on the user settings configuration file stored at the user home directory, attackers can read any file on the system, even if it is not readable to the user such as /etc/shadow, /etc/sudoes etc.
Vendor Status:
The vendor has issued a patch:
A patch for KDE 3.4.0 - KDE 3.5.3 is available from ftp://ftp.kde.org/pub/kde/security_patches :
9daecff07d57dabba35da247e752916a post-3.5.0-kdebase-kdm.diff
A patch for KDE 3.3.x is available from ftp://ftp.kde.org/pub/kde/security_patches :
f2e1424d97f2cd18674bef833274c5e3 post-3.3.0-kdebase-kdm.diff
A patch for KDE 3.2.x is available from ftp://ftp.kde.org/pub/kde/security_patches :
8aa6b41cccca4216c6eb1cf705c2370a post-3.2.0-kdebase-kdm.diff
CVE Information:
CVE-2006-2449
|
|
|
|
|
