KDE before 3.3.0 does not properly handle when certain symbolic links point to "stale" locations, which could allow local users to create or truncate arbitrary files.

According to a KDE Security Advisory, KDE may sometimes create temporary files without properly checking the ownership and type of the target path. This could allow a local attacker to cause KDE applications to overwrite arbitrary files.

New kdelibs and kdebase packages are available for Slackware 9.1, 10.0, and -current to fix security issues.

Updated kdelib and kdebase packages that resolve multiple security issues are now available.

The kdelibs packages include libraries for the K Desktop Environment.
The kdebase packages include core applications for the K Desktop Environment.

Andrew Tuitt reported that versions of KDE up to and including 3.2.3 create temporary directories with predictable names. A local attacker could prevent KDE applications from functioning correctly, or overwrite files owned by other users by creating malicious symlinks.
The Common Vulnerabilities and Exposures project has assigned the name CVE-2004-0689 to this issue.

WESTPOINT internet reconnaissance services has discovered that the KDE web browser Konqueror allows websites to set cookies for certain country specific secondary top level domains. An attacker within one of the affected domains could construct a cookie which would be sent to all other websites within the domain leading to a session fixation attack. This issue does not affect popular domains such as .co.uk, .co.in, or .com. The Common Vulnerabilities and Exposures project has assigned the name CVE-2004-0721 to this issue.

A frame injection spoofing vulnerability has been discovered in the Konqueror web browser. This issue could allow a malicious website to show arbitrary content in a named frame of a different browser window.
The Common Vulnerabilities and Exposures project has assigned the name CVE-2004-0746 to this issue.

All users of KDE are advised to upgrade to these erratum packages, which contain backported patches from the KDE team for these issues.

The SUSE security team was alerted that in some cases the integrity of symlinks used by KDE are not ensured and that these symlinks can be pointing to stale locations. This can be abused by a local attacker to create or truncate arbitrary files or to prevent KDE applications from functioning correctly.

Andrew Tuitt reported that versions of KDE up to and including 3.2.3 create temporary directories with predictable names. A local attacker could prevent KDE applications from functioning correctly, or overwrite files owned by other users by creating malicious symlinks.
The Common Vulnerabilities and Exposures project has assigned the name CVE-2004-0689 to this issue.

WESTPOINT internet reconnaissance services has discovered that the KDE web browser Konqueror allows websites to set cookies for certain country specific secondary top level domains. An attacker within one of the affected domains could construct a cookie which would be sent to all other websites within the domain leading to a session fixation attack. This issue does not affect popular domains such as .co.uk, .co.in, or .com. The Common Vulnerabilities and Exposures project has assigned the name CVE-2004-0721 to this issue.

A frame injection spoofing vulnerability has been discovered in the Konqueror web browser. This issue could allow a malicious website to show arbitrary content in a named frame of a different browser window.
The Common Vulnerabilities and Exposures project has assigned the name CVE-2004-0746 to this issue.

All users of KDE are advised to upgrade to these packages, which contain backported patches from the KDE team for these issues.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Andrew Tuitt reported that versions of KDE up to and including 3.2.3 create temporary directories with predictable names. A local attacker could prevent KDE applications from functioning correctly, or overwrite files owned by other users by creating malicious symlinks.
The Common Vulnerabilities and Exposures project has assigned the name CVE-2004-0689 to this issue.

WESTPOINT internet reconnaissance services has discovered that the KDE web browser Konqueror allows websites to set cookies for certain country specific secondary top level domains. An attacker within one of the affected domains could construct a cookie which would be sent to all other websites within the domain leading to a session fixation attack. This issue does not affect popular domains such as .co.uk, .co.in, or .com. The Common Vulnerabilities and Exposures project has assigned the name CVE-2004-0721 to this issue.

A frame injection spoofing vulnerability has been discovered in the Konqueror web browser. This issue could allow a malicious website to show arbitrary content in a named frame of a different browser window.
The Common Vulnerabilities and Exposures project has assigned the name CVE-2004-0746 to this issue.

All users of KDE are advised to upgrade to these erratum packages, which contain backported patches from the KDE team for these issues.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A number of vulnerabilities were discovered in KDE that are corrected with these update packages.

The integrity of symlinks used by KDE are not ensured and as a result can be abused by local attackers to create or truncate arbitrary files or to prevent KDE applications from functioning correctly (CVE-2004-0689).

The DCOPServer creates temporary files in an insecure manner. These temporary files are used for authentication-related purposes, so this could potentially allow a local attacker to compromise the account of any user running a KDE application (CVE-2004-0690). Note that only KDE 3.2.x is affected by this vulnerability.

The Konqueror web browser allows websites to load web pages into a frame of any other frame-based web page that the user may have open.
This could potentially allow a malicious website to make Konqueror insert its own frames into the page of an otherwise trusted website (CVE-2004-0721).

The Konqueror web browser also allows websites to set cookies for certain country-specific top-level domains. This can be done to make Konqueror send the cookies to all other web sites operating under the same domain, which can be abused to become part of a session fixation attack. All country-specific secondary top-level domains that use more than 2 characters in the secondary part of the domain name, and that use a secondary part other than com, net, mil, org, gove, edu, or int are affected (CVE-2004-0746).

ID	Name	Product	Family	Severity
24307	FreeBSD : kdelibs insecure temporary file handling (603fe36d-ec9d-11d8-b913-000c41e2cdad)	Nessus	FreeBSD Local Security Checks	medium
18782	Slackware 10.0 / 9.1 / current : kde (SSA:2004-247-01)	Nessus	Slackware Local Security Checks	high
15427	RHEL 2.1 / 3 : kdelibs, kdebase (RHSA-2004:412)	Nessus	Red Hat Local Security Checks	high
15376	Debian DSA-539-1 : kdelibs - temporary directory vulnerability	Nessus	Debian Local Security Checks	medium
14691	Fedora Core 2 : kdebase-3.2.2-6.FC2 (2004-293)	Nessus	Fedora Local Security Checks	medium
14690	Fedora Core 1 : kdebase-3.1.4-7 (2004-292)	Nessus	Fedora Local Security Checks	medium
14689	Fedora Core 2 : kdelibs-3.2.2-8.FC2 (2004-291)	Nessus	Fedora Local Security Checks	medium
14688	Fedora Core 1 : kdelibs-3.1.4-7 (2004-290)	Nessus	Fedora Local Security Checks	medium
14335	Mandrake Linux Security Advisory : kdelibs/kdebase (MDKSA-2004:086)	Nessus	Mandriva Local Security Checks	high

Detections

Analytics

CVE-2004-0689

high

Tenable Plugins

medium

high

high

medium

medium

medium

medium

medium

high