Gentoo Forums
Gentoo Forums
Gentoo Forums
Quick Search: in
[ GLSA 201708-04 ] Ked Password Manager
View unanswered posts
View posts from last 24 hours

 
Reply to topic    Gentoo Forums Forum Index News & Announcements
View previous topic :: View next topic  
Author Message
GLSA
Veteran
Veteran


Joined: 12 May 2004
Posts: 1969

PostPosted: Mon Aug 21, 2017 12:26 am    Post subject: [ GLSA 201708-04 ] Ked Password Manager Reply with quote

Gentoo Linux Security Advisory

Title: Ked Password Manager: Information leak (GLSA 201708-04)
Severity: normal
Exploitable: local, remote
Date: 2017-08-21
Updated: 2017-08-26
Bug(s): #616690
ID: 201708-04

Synopsis

An insecure file usage has been reported in Ked Password Manager
possibly allowing confidential information to be disclosed.


Background

Helps to manage large numbers of passwords and related information and
simplifies the tasks of searching and entering password data.


Affected Packages

Package: app-admin/kedpm
Vulnerable: <= 0.4.0-r2
Architectures: All supported architectures


Description

A history file in ~/.kedpm/history is written in clear text. All of the
commands performed in the password manager are written there. This can
lead to the disclosure of the master password if the “password”
command is used with an argument. The names of the password entries
created and consulted are also accessible in clear text.


Impact

An attacker could obtain confidential information.

Workaround

There is no known workaround at this time.

Resolution

Gentoo Security recommends that users unmerge Ked Password Manager:
Code:
# emerge --unmerge "app-admin/kedpm"
   


References

CVE-2017-8296


Last edited by GLSA on Fri Sep 29, 2017 4:16 am; edited 2 times in total
Back to top
View user's profile Send private message
Display posts from previous:   
Reply to topic    Gentoo Forums Forum Index News & Announcements All times are GMT
Page 1 of 1

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum