kcheckpass in KDE 3.2.0 up to 3.4.2 allows local users to gain root access via a symlink attack on lock files.

Updated kdebase packages that resolve several bugs are now available.

This update has been rated as having low security impact by the Red Hat Security Response Team.

The kdebase packages provide the core applications for KDE, the K Desktop Environment. These core packages include the file manager Konqueror.

Ilja van Sprundel discovered a lock file handling flaw in kcheckpass.
If the directory /var/lock is writable by a user who is allowed to run kcheckpass, that user could gain root privileges. In Red Hat Enterprise Linux, the /var/lock directory is not writable by users and therefore this flaw could only have been exploited if the permissions on that directory have been badly configured. A patch to block this issue has been included in this update. (CVE-2005-2494)

The following bugs have also been addressed :

  - kstart --tosystray does not send the window to the     system tray in Kicker

  - When the customer enters or selects URLs in Firefox's     address field, the desktop freezes for a couple of     seconds

  - fish kioslave is broken on 64-bit systems

All users of kdebase should upgrade to these updated packages, which contain patches to resolve these issues.

Ilja van Sprundel discovered a flaw in the lock file handling of kcheckpass. A local attacker could exploit this to execute arbitrary code with root privileges.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Ilja van Sprundel from suresec.org notified the KDE security team about a serious lock file handling error in kcheckpass that can, in some configurations, be used to gain root access.

In order for an exploit to succeed, the directory /var/lock has to be writeable for a user that is allowed to invoke kcheckpass.

The updated packages have been patched to correct this problem.

New kdebase packages are available for Slackware 10.0, 10.1, and
-current to fix a security issue with the kcheckpass program. Earlier versions of Slackware are not affected. A flaw in the way the program creates lockfiles could allow a local attacker to gain root privileges.

Ilja van Sprundel discovered a serious lock file handling error in kcheckpass that can, in some configurations, be used to gain root access.

ID	Name	Product	Family	Severity
22277	CentOS 4 : kdebase (CESA-2006:0582)	Nessus	CentOS Local Security Checks	high
22222	RHEL 4 : kdebase (RHSA-2006:0582)	Nessus	Red Hat Local Security Checks	high
20586	Ubuntu 5.04 : kdebase vulnerability (USN-176-1)	Nessus	Ubuntu Local Security Checks	high
19915	Mandrake Linux Security Advisory : kdebase (MDKSA-2005:160)	Nessus	Mandriva Local Security Checks	high
19861	Slackware 10.0 / 10.1 / current : kcheckpass in kdebase (SSA:2005-251-01)	Nessus	Slackware Local Security Checks	high
19711	Debian DSA-815-1 : kdebase - programming error	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2005-2494

high

Tenable Plugins

high

high

high

high

high

high