Gentoo Forums
Gentoo Forums
Gentoo Forums
Quick Search: in
[gentoo-announce] GLSA: kdenetwork
View unanswered posts
View posts from last 24 hours

 
Reply to topic    Gentoo Forums Forum Index News & Announcements
View previous topic :: View next topic  
Author Message
klieber
Bodhisattva
Bodhisattva


Joined: 17 Apr 2002
Posts: 3657
Location: San Francisco, CA

PostPosted: Thu Nov 14, 2002 1:43 pm    Post subject: [gentoo-announce] GLSA: kdenetwork Reply with quote

Daniel Ahlberg wrote:
- - --------------------------------------------------------------------
GENTOO LINUX SECURITY ANNOUNCEMENT 200211-004
- - --------------------------------------------------------------------

PACKAGE : kdenetwork
SUMMARY : rlogin.protocol and telnet.protocol URL KIO Vulnerability
resLISa / LISa Vulnerabilities
DATE : DATUM
EXPLOIT : local & remote

- - --------------------------------------------------------------------

from KDE advisory 20021111-1 :

The implementation of the rlogin protocol in all of the affected systems, and the implementation of the telnet protocol in affected KDE 2 systems, allows a carefully crafted URL in an HTML page, HTML email or other KIO-enabled application to execute arbitrary commands on the system using the victim's account on the vulnerable machine.

The vulnerability potentially enables local or remote attackers to compromise a victim's account and execute arbitrary commands on the local system with the victim's privileges, such as erasing files, accessing data or installing trojans.

Read the full advisory at
http://www.kde.org/info/security/advisory-20021111-1.txt

from KDE advisory 20021111-2 :

The resLISa daemon contains a buffer overflow vulnerability which potentially enables any local user to obtain access to a raw socket if 'reslisa' is installed SUID root. This vulnerability was discovered by the iDEFENSE security team and Texonet.

The lisa daemon contains a buffer overflow vulnerability which potentially enables any local user, as well any any remote attacker on the LAN who is able to gain control of the LISa port (7741 by default), to obtain root privileges.

In addition, a remote attacker potentially may be able to gain access to a victim's account by using an "lan://" URL in an HTML page or via another KDE application. These vulnerabilities were discovered by Olaf Kirch at SuSE Linux AG.

Read the full advisory at
http://www.kde.org/info/security/advisory-20021111-2.txt

More information is available at
http://www.idefense.com/advisory/11.11.02.txt

SOLUTION

It is recommended that all Gentoo Linux users who are running kde-base/kdenetwork-3.0.4 and earlier update their systems as follows:

emerge rsync
emerge kdenetwork
emerge clean

- - --------------------------------------------------------------------
aliz@gentoo.org - GnuPG key is available at www.gentoo.org/~aliz
hannes@gentoo.org
- - --------------------------------------------------------------------

Mailing List Archive : unavailable

--kurt
_________________
The problem with political jokes is that they get elected
Back to top
View user's profile Send private message
Display posts from previous:   
Reply to topic    Gentoo Forums Forum Index News & Announcements All times are GMT
Page 1 of 1

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum