DSA-1156 kdebase

Bulletin has no description...

CentOS 4 : kdebase (CESA-2006:0548)

Updated kdebase packages that correct a security flaw in kdm are now available for Red Hat Enterprise Linux 4. This update has been rated as having important security impact by the Red Hat Security Response Team. The kdebase packages provide the core applications for KDE, the K Desktop Environmen...

SSA-2006-0628032502

New kdebase packages are available for Slackware 10.0, 10.1, 10.2, and -current to fix a security issue with KDM the KDE login manager which could be exploited by a local attacker to read any file on the system. The official KDE security advisory may be found here:...

kdebase kdm local file reading vulnerability

New kdebase packages are available for Slackware 10.0, 10.1, 10.2, and -current to fix a security issue with KDM the KDE login manager which could be exploited by a local attacker to read any file on the system. The official KDE security advisory may be found here:...

GLSA-200606-23 : KDM: Symlink vulnerability

The remote host is affected by the vulnerability described in GLSA-200606-23 KDM: Symlink vulnerability Ludwig Nussel discovered that KDM could be tricked into allowing users to read files that would otherwise not be readable. Impact : A local attacker could exploit this issue to obtain potential...

KDM: Symlink vulnerability

Background KDE is a feature-rich graphical desktop environment for Linux and Unix-like Operating Systems. KDM is the KDE Display Manager and is part of the kdebase package. Description Ludwig Nussel discovered that KDM could be tricked into allowing users to read files that would otherwise not be...

Mandrake Linux Security Advisory : kdebase (MDKSA-2006:105)

A problem with how kdm manages the /.dmrc file was discovered by Ludwig Nussel. By using a symlink attack, a local user could get kdm to read arbitrary files on the system, including privileged system files and those belonging to other users. The updated packages have been patched to correct thes...

RHEL 4 : kdebase (RHSA-2006:0548)

Updated kdebase packages that correct a security flaw in kdm are now available for Red Hat Enterprise Linux 4. This update has been rated as having important security impact by the Red Hat Security Response Team. The kdebase packages provide the core applications for KDE, the K Desktop Environmen...

CVE-2006-2449

The CVE-2006-2449 entry concerns KDE Display Manager (KDM) in KDE 3.2.0 through 3.5.3. The issue arises from how KDM handles the session type for login, allowing a local attacker to read arbitrary files via a symlink attack to the session configuration. The vulnerability is local in scope and doe...

USN-301-1: kdm vulnerability

Ludwig Nussel discovered that kdm managed the /.dmrc file in an insecure way. By performing a symlink attack, a local user could exploit this to read arbitrary files on the system, like private files of other users, /etc/shadow, and similarly sensitive data...

Important: Red Hat Security Advisory: kdebase security update

Updated kdebase packages that correct a security flaw in kdm are now available for Red Hat Enterprise Linux 4. This update has been rated as having important security impact by the Red Hat Security Response Team. The kdebase packages provide the core applications for KDE, the K Desktop Environmen...

Mandrake Linux Security Advisory : kdebase (MDKSA-2003:091)

A vulnerability was discovered in all versions of KDE 2.2.0 up to and including 3.1.3. KDM does not check for successful completion of the pamsetcred call and in the case of error conditions in the installed PAM modules, KDM may grant local root access to any user with valid login credentials. It...

RHEL 2.1 : kdebase (RHSA-2003:270)

Updated KDE packages that resolve a local security issue with KDM PAM support and weak session cookie generation are now available. KDE is a graphical desktop environment for the X Window System. KDE between versions 2.2.0 and 3.1.3 inclusive contain a bug in the KDE Display Manager KDM when...

kdebase: KDM vulnerabilities

Background KDM is the desktop manager included with the K Desktop Environment. Description Firstly, versions of KDM =kde-base/kde-3.1.4' emerge '=kde-base/kde-3.1.4' emerge clean...

CVE-2003-0692

CVE-2003-0690 and CAN-2003-0692 describe vulnerabilities in KDE KDEbase/KDM before patches: KDM may grant local root or escalate privileges if pam_setcred() fails during PAM processing, and the session cookie generation used by KDM is too weak (less than 128 bits of entropy), enabling brute-force...

CVE-2003-0690

Concretely, CVE-2003-0690 affects KDE kdebase (KDM in KDE 3.1.3 and earlier). The flaw is that kdebase does not verify whether pam_setcred succeeds, which can allow a root privilege escalation under certain PAM module configurations (notably MIT pam_krb5). Public sources in connected docs referen...

CVE-2003-0692

KDM in KDE 3.1.3 and earlier uses a weak session cookie generation algorithm that does not provide 128 bits of entropy, which allows attackers to guess session cookies via brute force methods and gain access to the user session...

CVE-2003-0690: Undefined Security Weakness

KDM in KDE 3.1.3 and earlier does not verify whether the pamsetcred function call succeeds, which may allow attackers to gain root privileges by triggering error conditions within PAM modules, as demonstrated in certain configurations of the MIT pamkrb5 module...

CVE-2003-0692: Undefined Security Weakness

KDM in KDE 3.1.3 and earlier uses a weak session cookie generation algorithm that does not provide 128 bits of entropy, which allows attackers to guess session cookies via brute force methods and gain access to the user session...

[KDE SECURITY ADVISORY] KDM vulnerabilities

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 KDE Security Advisory: KDM vulnerabilities Original Release Date: 2003-09-16 URL: http://www.kde.org/info/security/advisory-20030916-1.txt 0. References http://cert.uni-stuttgart.de/archive/suse/security/2002/12/ msg00101.html...