KDE: Local Denial of service

Background

KDE is a feature-rich graphical desktop environment for Linux and Unix-like Operating Systems. DCOP is KDE’s simple IPC/RPC mechanism.

Description

Sebastian Krahmer discovered that it is possible to stall the dcopserver of other users.

Impact

An attacker could exploit this to cause a local Denial of Service by stalling the dcopserver in the authentication process. As a result all desktop functionality relying on DCOP will cease to function.

Workaround

There is no known workaround at this time.

Resolution

All kdelibs users should upgrade to the latest version:

 # emerge --sync
 # emerge --ask --oneshot --verbose kde-base/kdelibs