107 matches found
PT-2019-18616 · Kde +3 · Kde Kauth +3
Name of the Vulnerable Software and Affected Versions: KDE KAuth versions prior to 5.55 Description: The issue allows the passing of parameters with arbitrary types to helpers running as root over DBus via DBusHelperProxy.cpp. This can cause crashes and trigger the decoding of arbitrary images wi...
FreeBSD : kf5-kauth -- Insecure handling of arguments in helpers (e8bcac84-2d5c-11e9-9a74-e0d55e2a8bf9)
Albert Astals Cid reports : KAuth allows to pass parameters with arbitrary types to helpers running as root over DBus. Certain types can cause crashes and trigger decoding arbitrary images with dynamically loaded plugin C Tenable Network Security, Inc. The descriptive text and package checks in...
kf5-kauth -- Insecure handling of arguments in helpers
Albert Astals Cid reports: KAuth allows to pass parameters with arbitrary types to helpers running as root over DBus. Certain types can cause crashes and trigger decoding arbitrary images with dynamically loaded plugin...
An Open-Source Pre and Post Callback-Based Framework for macOS Kernel Monitoring: Kemon
If third-party vendors want to add new features to the macOS kernel, such as antivirus capabilities, ransomware blocking, data breach auditing, behavior monitoring and so on, they usually need the support of the system’s exported interfaces. At present, only two known official interfaces are...
Updated kauth and kdelibs4 packages fix security vulnerability
Sebastian Krahmer from SUSE discovered that the KAuth framework contains a logic flaw in which the service invoking dbus is not properly checked. This flaw allows spoofing the identity of the caller and gaining root privileges from an unprivileged account CVE-2017-8422...
MGASA-2017-0274 Updated kauth and kdelibs4 packages fix security vulnerability
Sebastian Krahmer from SUSE discovered that the KAuth framework contains a logic flaw in which the service invoking dbus is not properly checked. This flaw allows spoofing the identity of the caller and gaining root privileges from an unprivileged account CVE-2017-8422...
Fedora 26 : kf5-kauth (2017-0898c704a1)
security fix for CVE-2017-8422. https://www.kde.org/info/security/advisory-20170510-1.txt Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible...
GLSA-201706-29 : KAuth and KDELibs: Privilege escalation
The remote host is affected by the vulnerability described in GLSA-201706-29 KAuth and KDELibs: Privilege escalation KAuth and KDELibs contains a logic flaw in which the service invoking D-Bus is not properly checked. This allows spoofing the identity of the caller and with some carefully crafted...
KAuth and KDELibs: Privilege escalation
Background KAuth provides a convenient, system-integrated way to offload actions that need to be performed as a privileged user root, for example to small hopefully secure helper utilities. The KDE libraries, basis of KDE and used by many open source projects. Description KAuth and KDELibs contai...
Debian DLA-952-1 : kde4libs security update
Several vulnerabilities were discovered in kde4libs, the core libraries for all KDE 4 applications. The Common Vulnerabilities and Exposures project identifies the following problems : CVE-2017-6410 Itzik Kotler, Yonatan Fridburg and Amit Klein of Safebreach Labs reported that URLs are not...
[SECURITY] [DLA 952-1] kde4libs security update
Package : kde4libs Version : 4:4.8.4-4+deb7u3 CVE ID : CVE-2013-2074 CVE-2017-6410 CVE-2017-8422 Debian Bug : 856890 Several vulnerabilities were discovered in kde4libs, the core libraries for all KDE 4 applications. The Common Vulnerabilities and Exposures project identifies the following...
Oracle Linux 7 : kdelibs (ELSA-2017-1264)
The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2017-1264 advisory. 6:4.14.8-6 - KAuth: verify that whoever is calling us is actually who he says he is CVE-2017-8422 Resolves: CVE-2017-8422 Tenable has extracted the preceding...
KDE 4/5 - KAuth Privilege Escalation Exploit
Exploit for linux platform in category local exploits // cc -Wall smb0k.c -pedantic -std=c11 // // smb4k PoC, also demonstrating broader scope of a generic kde // authentication bypass vulnerability // // C 2017 Sebastian Krahmer // define POSIXCSOURCE 200112L include include include include...
KDE kauth and kdelibs Logic Flaw Lets Local Users Obtain Root Privileges(CVE-2017-8422)
This document describes a generic root exploit against kde. The exploit is achieved by abusing a logic flaw within the KAuth framework which is present in kde4 org.kde.auth and kde5 org.kde.kf5auth. It is possible to spoof what KAuth calls callerID's which are indeed D-Bus unique names of the...
SUSE SLED12 / SLES12 Security Update : kdelibs4 (SUSE-SU-2017:1335-1)
This update for kdelibs4 fixes the following issues : - CVE-2017-8422: This update fixes problem in the DBUS authentication of the kauth framework that could be used to escalate privileges depending on bugs or misimplemented dbus services. boo1036244 Note that Tenable Network Security has extract...
KDE kauth and kdelibs local elevation of privilege vulnerability
KDE kauth and kdelibs are both products of the KDE community. kauth is a cross-platform authentication API; kdelibs is a reference library of KDE APIs created on top of the Qt framework for developing KDE software. A local elevation of privilege vulnerability exists in KDE kauth and kdelibs. A...
KDE 45 - KAuth Local Privilege Escalation
KDE 45 - KAuth Local Privilege Escalation // cc -Wall smb0k.c -pedantic -std=c11 // // smb4k PoC, also demonstrating broader scope of a generic kde // authentication bypass vulnerability // // C 2017 Sebastian Krahmer // define POSIXCSOURCE 200112L include include include include include include...
KDE 4/5 - 'KAuth' Local Privilege Escalation
// cc -Wall smb0k.c -pedantic -std=c11 // // smb4k PoC, also demonstrating broader scope of a generic kde // authentication bypass vulnerability // // C 2017 Sebastian Krahmer // define POSIXCSOURCE 200112L include include include include include include include include include void dieconst char...
