KDE Display Manager (KDM) in KDE 3.2.0 up to 3.5.3 allows local users to read arbitrary files via a symlink attack related to the session type for login.

Ludwig Nussel discovered that kdm managed the ~/.dmrc file in an insecure way. By performing a symlink attack, a local user could exploit this to read arbitrary files on the system, like private files of other users, /etc/shadow, and similarly sensitive data.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

KDM stores the type of the previously used session in the user's home directory. By using a symlink users could trick kdm into also storing content of files that are normally not accesible by users (CVE-2006-2449).

Ludwig Nussel discovered that kdm, the X display manager for KDE, handles access to the session type configuration file insecurely, which may lead to the disclosure of arbitrary files through a symlink attack.

Updated kdebase packages that correct a security flaw in kdm are now available for Red Hat Enterprise Linux 4.

This update has been rated as having important security impact by the Red Hat Security Response Team.

The kdebase packages provide the core applications for KDE, the K Desktop Environment. These core packages include the KDE Display Manager (KDM).

Ludwig Nussel discovered a flaw in KDM. A malicious local KDM user could use a symlink attack to read an arbitrary file that they would not normally have permissions to read. (CVE-2006-2449)

Note: this issue does not affect the version of KDM as shipped with Red Hat Enterprise Linux 2.1 or 3.

All users of KDM should upgrade to these updated packages which contain a backported patch to correct this issue.

New kdebase packages are available for Slackware 10.0, 10.1, 10.2, and -current to fix a security issue with KDM (the KDE login manager) which could be exploited by a local attacker to read any file on the system. The official KDE security advisory may be found here:
http://www.kde.org/info/security/advisory-20060614-1.txt

The remote host is affected by the vulnerability described in GLSA-200606-23 (KDM: Symlink vulnerability)

    Ludwig Nussel discovered that KDM could be tricked into allowing users     to read files that would otherwise not be readable.
  Impact :

    A local attacker could exploit this issue to obtain potentially     sensitive information that is usually not accessable to the local user     such as shadow files or other user's files. The default Gentoo user     running KDM is root and, as a result, the local attacker can read any     file.
  Workaround :

    There is no known workaround at this time.

A problem with how kdm manages the ~/.dmrc file was discovered by Ludwig Nussel. By using a symlink attack, a local user could get kdm to read arbitrary files on the system, including privileged system files and those belonging to other users.

The updated packages have been patched to correct these issues.

ID	Name	Product	Family	Severity
27876	Ubuntu 5.04 / 5.10 / 6.06 LTS : kdebase vulnerability (USN-301-1)	Nessus	Ubuntu Local Security Checks	medium
27285	openSUSE 10 Security Update : kdebase3-kdm (kdebase3-kdm-1609)	Nessus	SuSE Local Security Checks	medium
22698	Debian DSA-1156-1 : kdebase - programming error	Nessus	Debian Local Security Checks	medium
22002	CentOS 4 : kdebase (CESA-2006:0548)	Nessus	CentOS Local Security Checks	medium
21765	Slackware 10.0 / 10.1 / 10.2 / current : kdebase kdm local file reading vulnerability (SSA:2006-178-01)	Nessus	Slackware Local Security Checks	medium
21743	GLSA-200606-23 : KDM: Symlink vulnerability	Nessus	Gentoo Local Security Checks	medium
21722	RHEL 4 : kdebase (RHSA-2006:0548)	Nessus	Red Hat Local Security Checks	medium
21720	Mandrake Linux Security Advisory : kdebase (MDKSA-2006:105)	Nessus	Mandriva Local Security Checks	medium

Detections

Analytics

CVE-2006-2449

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium