lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Message-ID: <20021114090439.4B4243392B@mail1.tamperd.net>
From: aliz at gentoo.org (Daniel Ahlberg)
Subject: GLSA: kdenetwork

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- - --------------------------------------------------------------------
GENTOO LINUX SECURITY ANNOUNCEMENT 200211-004
- - --------------------------------------------------------------------

PACKAGE : kdenetwork
SUMMARY : rlogin.protocol and telnet.protocol URL KIO Vulnerability
          resLISa / LISa Vulnerabilities
DATE    : DATUM
EXPLOIT : local & remote

- - --------------------------------------------------------------------

from KDE advisory 20021111-1 :

The implementation of the rlogin protocol in all of the affected
systems, and the implementation of the telnet protocol in affected
KDE 2 systems, allows a carefully crafted URL in an HTML page,
HTML email or other KIO-enabled application to execute arbitrary
commands on the system using the victim's account on the
vulnerable machine.

The vulnerability potentially enables local or remote attackers
to compromise a victim's account and execute arbitrary commands
on the local system with the victim's privileges, such as erasing
files, accessing data or installing trojans.

Read the full advisory at
http://www.kde.org/info/security/advisory-20021111-1.txt

from KDE advisory 20021111-2 :

The resLISa daemon contains a buffer overflow vulnerability which
potentially enables any local user to obtain access to a raw socket
if 'reslisa' is installed SUID root.  This vulnerability was
discovered by the iDEFENSE security team and Texonet.

The lisa daemon contains a buffer overflow vulnerability which
potentially enables any local user, as well any any remote attacker
on the LAN who is able to gain control of the LISa port (7741 by
default), to obtain root privileges.

In addition, a remote attacker potentially may be able to gain
access to a victim's account by using an "lan://" URL in an HTML
page or via another KDE application.  These vulnerabilities were
discovered by Olaf Kirch at SuSE Linux AG.

Read the full advisory at
http://www.kde.org/info/security/advisory-20021111-2.txt

More information is available at
http://www.idefense.com/advisory/11.11.02.txt

SOLUTION

It is recommended that all Gentoo Linux users who are running
kde-base/kdenetwork-3.0.4 and earlier update their systems as follows:

emerge rsync
emerge kdenetwork
emerge clean

- - --------------------------------------------------------------------
aliz@...too.org - GnuPG key is available at www.gentoo.org/~aliz
hannes@...too.org
- - --------------------------------------------------------------------
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.7 (GNU/Linux)

iD8DBQE902cmfT7nyhUpoZMRAt8pAJ9dDutM8qF2/jxTMZ7KQutTjhuLMwCgrZoU
d5XyUrE6eAWBiIWQ+V/FfdA=
=JhtY
-----END PGP SIGNATURE-----

Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ