Multiple KDE Security Advisories (2005-03-16)

Three KDE security advisories have been issued today.

KDE Security Advisory: Local DCOP denial of service vulnerability
Original Release Date: 20050316
URL: http://www.kde.org/info/security/advisory-20050316-1.txt

0. References
   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0396

1. Systems affected:

    All KDE version prior to KDE 3.4 on systems where multiple users
    have access.
   

2. Overview:

    Sebastian Krahmer of the SUSE LINUX Security Team reported a local
    denial of service vulnerability in KDE's Desktop Communication
    Protocol (DCOP) daemon better known as dcopserver.
   
    A local user can lock up the dcopserver of arbitrary other users
    on the same machine by stalling the DCOP authentication process.
   
    Although it is not possible to by pass the authentication process
    this way, it can cause a significant reduction in desktop
    functionality for the affected users.
   
    The Common Vulnerabilities and Exposures project (cve.mitre.org)
    has assigned the name CAN-2005-0396 to this issue.
   

3. Impact:

    A local user can lock up the dcopserver of arbitrary other users
    on the same machine. This can cause a significant reduction in
    desktop functionality for the affected users including, but not
    limited to, the inability to browse the internet and the inability
    to start new applications.
   

4. Solution:

    Upgrade to KDE 3.4.
   
    For older versions of KDE Source code patches have been made
    available which fix these vulnerabilities. Contact your OS vendor /
    binary package provider for information about how to obtain updated
    binary packages.
   

5. Patch:

    A patch for KDE 3.1.x is available from
    ftp://ftp.kde.org/pub/kde/security_patches
   
    377c49d8224612fbf09f70f3c09d52f5  post-3.1.5-kdelibs-dcop.patch
   
    A patch for KDE 3.2.x is available from
    ftp://ftp.kde.org/pub/kde/security_patches
   
    0948701bffb082c65784dc8a2b648ef0  post-3.2.3-kdelibs-dcop.patch
   
    A patch for KDE 3.3.x is available from
    ftp://ftp.kde.org/pub/kde/security_patches
   
    7309e259ae1f29be08bbb70e580da3fb  post-3.3.2-kdelibs-dcop.patch
   

6. Time line and credits:

    21/02/2005 KDE Security informed by SUSE LINUX.
    21/02/2005 Patches applied to KDE CVS.
    02/03/2005 Vendors notified
    16/03/2005 KDE Security Advisory released.
   

KDE Security Advisory: Konqueror International Domain Name Spoofing
Original Release Date: 20050316
URL: http://www.kde.org/info/security/advisory-20050316-2.txt

0. References
   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0237
   http://bugs.kde.org/show_bug.cgi?id=98788
   http://lists.netsys.com/pipermail/full-disclosure/2005-February/031459.html
   http://lists.netsys.com/pipermail/full-disclosure/2005-February/031460.html
   http://www.shmoo.com/idn
   http://www.shmoo.com/idn/homograph.txt
   http://xforce.iss.net/xforce/xfdb/19236
   http://secunia.com/advisories/14162/

1. Systems affected:

    All KDE versions in the KDE 3.2.x and KDE 3.3.x series.
   

2. Overview:

    Since version 3.2 KDE and it's webbrowser Konqueror have support
    for International Domain Names (IDN). Unfortunately this has
    made KDE vulnerable to a phishing technique known as a 
    Homograph attack.
   
    IDN allows a website to use a wide range of international characters
    in its domain name. Unfortunately some of these characters have a
    strong resemblance to other characters, so called homographs. This
    makes it possible for a website to use a domain name that is
    technically different from another well known domain name, but has
    no or very little visual differences.
   
    This lack of visual difference can be abused by attackers to
    trick users into visiting malicious websites that resemble
    a well known and trusted website in order to obtain personal
    information such as credit card details.
   
    The Common Vulnerabilities and Exposures project (cve.mitre.org)
    has assigned the name CAN-2005-0237 to this issue.
   
    For KDE 3.4 KDE and the Konqueror webbrowser have adopted a
    whitelist of domains for which IDN is safe to use because the
    registrar for these domains has implemented anti-homographic
    character policies or otherwise limited the available set of
    characters to prevent spoofing.
   

3. Impact:

    Users can be tricked into visiting a malicious website that
    resembles a well known and trusted website without getting any
    visual indication that this website differs from the one the
    user was expecting to visit.
   

4. Solution:

    Upgrade to KDE 3.4.
   
    For older versions of KDE Source code patches have been made
    available which fix these vulnerabilities. Contact your OS vendor /
    binary package provider for information about how to obtain updated
    binary packages.
   

5. Patch:

    A patch for KDE 3.2.x is available from
    ftp://ftp.kde.org/pub/kde/security_patches
   
    611bad3cb9ae46ac35b907c7321da7aa  post-3.2.3-kdelibs-idn.patch
   
    A patch for KDE 3.3.x is available from
    ftp://ftp.kde.org/pub/kde/security_patches
   
    c87754dbbaca4cdfeb26626a908fab5f  post-3.3.2-kdelibs-idn.patch
   

6. Time line and credits:

    07/02/2005 Issue raised by Eric Johanson on full-disclosure
    03/03/2005 Patches applied to KDE CVS.
    04/03/2005 Vendors notified
    16/03/2005 KDE Security Advisory released.
   

KDE Security Advisory: Insecure temporary file creation by dcopidlng
Original Release Date: 20050316
URL: http://www.kde.org/info/security/advisory-20050316-3.txt

0. References
   http://bugs.kde.org/show_bug.cgi?id=97608
   http://www.gentoo.org/security/en/glsa/glsa-200503-14.xml
   http://bugs.gentoo.org/attachment.cgi?id=51120&action=view
   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0365

1. Systems affected:

    All KDE versions in the KDE 3.2.x and KDE 3.3.x series.
    This problem only affects users who compile KDE or KDE applications
    themselves.
   

2. Overview:

    The dcopidlng script is vulnerable to symlink attacks, potentially
    allowing a local user to overwrite arbitrary files of a user when
    the script is run on behalf of that user.
   
    The dcopidlng script is run as part of the build process of KDE
    itself and may be used by the build process of third party KDE
    applications.
   
    The Common Vulnerabilities and Exposures project (cve.mitre.org)
    has assigned the name CAN-2005-0365 to this issue.
   

3. Impact:

    The dcopidlng script is vulnerable to symlink attacks, potentially
    allowing a local user to overwrite arbitrary files of a user when
    that user compiles KDE or third party KDE applications that use the
    dcopidlng script as part of their build process.
   

4. Solution:

    Upgrade to KDE 3.4.
   
    For older versions of KDE Source code patches have been made
    available which fix these vulnerabilities.
   
    Installed versions of dcopidlng can be patched manually as follows:
   
        cd $(kde-config --expandvars --install exe)
        patch < ~/post-3.2.3-kdelibs-dcopidlng.patch
   

5. Patch:

    A patch for KDE 3.2.x is available from
    ftp://ftp.kde.org/pub/kde/security_patches
   
    43213bb9876704041af622ed2a6903ae  post-3.2.3-kdelibs-dcopidlng.patch
   
    A patch for KDE 3.3.x is available from
    ftp://ftp.kde.org/pub/kde/security_patches
   
    43213bb9876704041af622ed2a6903ae  post-3.3.2-kdelibs-dcopidlng.patch
   

6. Time line and credits:

    21/01/2005 Problem reported to bugs.kde.org by Davide Madrisan
    21/01/2005 Patches applied to KDE CVS.
    16/03/2005 KDE Security Advisory released.