The dcopidlng script in KDE 3.2.x and 3.3.x creates temporary files with predictable filenames, which allows local users to overwrite arbitrary files via a symlink attack.

- Wed Mar 23 2005 Than Ngo <than at redhat.com>     6:3.3.1-2.9.FC3

  - Applied patch to fix konqueror international domain name     spoofing, CVE-2005-0237, #147405

  - get rid of broken AltiVec instructions on ppc

  - Wed Mar 2 2005 Than Ngo <than at redhat.com>     6:3.3.1-2.8.FC3

  - Applied patch to fix DCOP DoS, CVE-2005-0396, #150092     thanks KDE security team

  - Wed Feb 16 2005 Than Ngo <than at redhat.com>     6:3.3.1-2.7.FC3

  - Applied patch to fix dcopidlng insecure temporary file     usage, CVE-2005-0365, #148823

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Davide Madrisan reports :

The `dcopidlng' script in the KDE library package (kdelibs-3.3.2/dcop/dcopidlng/dcopidlng) creates temporary files in a unsecure manner.

Note: dcopidlng is only used at build time, so only users installing KDE are vulnerable, not users already running KDE.

The remote Redhat Enterprise Linux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2005:325 advisory.

    The kdelibs package provides libraries for the K Desktop Environment.

    The International Domain Name (IDN) support in the Konqueror browser     allowed remote attackers to spoof domain names using punycode encoded     domain names.  Such domain names are decoded in URLs and SSL certificates     in a way that uses homograph characters from other character sets, which     facilitates phishing attacks. The Common Vulnerabilities and Exposures     project (cve.mitre.org) has assigned the name CAN-2005-0237 to this issue.

    Sebastian Krahmer discovered a flaw in dcopserver, the KDE Desktop     Communication Protocol (DCOP) daemon.  A local user could use this flaw to     stall the DCOP authentication process, affecting any local desktop users     and causing a reduction in their desktop functionality.  The Common     Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name     CAN-2005-0396 to this issue.

    A flaw in the dcopidlng script was discovered. The dcopidlng script would     create temporary files with predictable filenames which could allow local     users to overwrite arbitrary files via a symlink attack. The Common     Vulnerabilities and Exposures project (cve.mitre.org) has assigned     the name CAN-2005-0365 to this issue.

    Users of KDE should upgrade to these erratum packages which contain     backported patches to correct these issues.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

A vulnerability in dcopserver was discovered by Sebastian Krahmer of the SUSE security team. A local user can lock up the dcopserver of other users on the same machine by stalling the DCOP authentication process, causing a local Denial of Service. dcopserver is the KDE Desktop Communication Procotol daemon (CVE-2005-0396).

As well, the IDN (International Domain Names) support in Konqueror is vulnerable to a phishing technique known as a Homograph attack. This attack is made possible due to IDN allowing a website to use a wide range of international characters that have a strong resemblance to other characters. This can be used to trick users into thinking they are on a different trusted site when they are in fact on a site mocked up to look legitimate using these other characters, known as homographs. This can be used to trick users into providing personal information to a site they think is trusted (CVE-2005-0237).

Finally, it was found that the dcopidlng script was vulnerable to symlink attacks, potentially allowing a local user to overwrite arbitrary files of a user when the script is run on behalf of that user. However, this script is only used as part of the build process of KDE itself and may also be used by the build processes of third- party KDE applications (CVE-2005-0365).

The updated packages are patched to deal with these issues and Mandrakesoft encourages all users to upgrade immediately.

The remote host is affected by the vulnerability described in GLSA-200503-14 (KDE dcopidlng: Insecure temporary file creation)

    Davide Madrisan has discovered that the dcopidlng script creates     temporary files in a world-writable directory with predictable names.
  Impact :

    A local attacker could create symbolic links in the temporary     files directory, pointing to a valid file somewhere on the filesystem.
    When dcopidlng is executed, this would result in the file being     overwritten with the rights of the user running the utility, which     could be the root user.
  Workaround :

    There is no known workaround at this time.

A bug in the way kioslave handles URL-encoded newline (%0a) characters before the FTP command was discovered. Because of this, it is possible that a specially crafted URL could be used to execute any ftp command on a remote server, or even send unsolicited email.

As well, Davide Madrisan discovered that dcopidlng created temporary files in an insecure manner.

The updated packages are patched to deal with these issues.

ID	Name	Product	Family	Severity
19631	Fedora Core 3 : kdelibs-3.3.1-2.9.FC3 (2005-245)	Nessus	Fedora Local Security Checks	low
18881	FreeBSD : kdelibs -- insecure temporary file creation (29dd0065-81fa-11d9-a9e7-0001020eed82)	Nessus	FreeBSD Local Security Checks	low
17625	RHEL 4 : kdelibs (RHSA-2005:325)	Nessus	Red Hat Local Security Checks	medium
17346	Mandrake Linux Security Advisory : kdelibs (MDKSA-2005:058)	Nessus	Mandriva Local Security Checks	high
17288	GLSA-200503-14 : KDE dcopidlng: Insecure temporary file creation	Nessus	Gentoo Local Security Checks	low
17140	Mandrake Linux Security Advisory : kdelibs (MDKSA-2005:045)	Nessus	Mandriva Local Security Checks	high

Detections

Analytics

CVE-2005-0365

medium

Tenable Plugins

low

low

medium

high

low

high