|
Brought to you by:
Suppliers of:
|
|
|
| |
| KDE, an open source desktop environment, suffers from several bugs that pose a security risk. |
| |
Credit:
The information has been provided by Tim Brown.
The original article can be found at: http://www.ocert.org/advisories/ocert-2009-015.html
|
| |
Vulnerable Systems:
* KDE version 4.3.2 and prior
Immune Systems:
* KDE version 4.3.3
The oCERT team was contacted by Portcullis Security requesting help in handling a series of issues reported to the KDE project back in July 2007. Because of an extended period of non-disclosure Portcullis decided to resubmit the issues to KDE and contacted oCERT asking for assistance in disclosure coordination.
Ark input sanitization errors: The KDE archiving tool, Ark, performs insufficient validation which leads to specially crafted archive files, using unknown MIME types, to be rendered using a KHTML instance, this can trigger uncontrolled XMLHTTPRequests to remote sites.
IO Slaves input sanitization errors: KDE protocol handlers perform insufficient input validation, an attacker can craft malicious URI that would trigger JavaScript execution. Additionally the 'help://' protocol handler suffer from directory traversal. It should be noted that the scope of this issue is limited as the malicious URIs cannot be embedded in Internet hosted content.
KMail input sanitization errors: The KDE mail client, KMail, performs insufficient validation which leads to specially crafted email attachments, using unknown MIME types, to be rendered using a KHTML instance, this can trigger uncontrolled XMLHTTPRequests to remote sites.
The exploitation of these vulnerabilities is unlikely according to Portcullis and KDE but the execution of active content is nonetheless unexpected and might pose a threat.
Disclosure Timeline:
2009-02-18: vulnerability report received
2009-02-19: contacted KDE security team
2009-03-05: KDE acknowledges the report, provides preliminary analysis for the reported issues
2009-10-15: KDE commits all outstanding fixes
2009-10-27: advisory release
|
|
|
|
|
