kphone -- insecure file creation

2006-05-19T00:00:00
ID DSA-1062
Type debian
Reporter Debian
Modified 2006-05-19T00:00:00

Description

Sven Dreyer discovered that KPhone, a Voice over IP client for KDE, creates a configuration file world-readable, which could leak sensitive information like SIP passwords.

The old stable distribution (woody) doesn't contain kphone packages.

For the stable distribution (sarge) this problem has been fixed in version 4.1.0-2sarge1.

For the unstable distribution (sid) this problem has been fixed in version 4.2-6.

We recommend that you upgrade your kphone package. If your current kphonerc has too lax permissions, you'll need to reset them manually.