Directory traversal vulnerability in the KGetMetalink::File::isValidNameAttr function in ui/metalinkcreator/metalinker.cpp in KGet in KDE SC 4.6.2 and earlier allows remote attackers to create arbitrary files via a .. (dot dot) in the name attribute of a file element in a metalink file. NOTE: this vulnerability exists because of an incomplete fix for CVE-2010-1000.

The remote Oracle Linux 6 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2011-0465 advisory.

    [7:4.3.4-11.1]
    - CVE-2010-1000, improper sanitization of metalink attribute for downloading files

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

A directory traversal flaw was found in the way KGet, a download manager, handled the 'file' element in Metalink files. An attacker could use this flaw to create a specially crafted Metalink file that, when opened, would cause KGet to overwrite arbitrary files accessible to the user running KGet. (CVE-2011-1586)

The desktop must be restarted (log out, then log back in) for this update to take effect.

It was discovered that KGet did not properly perform input validation when processing metalink files. If a user were tricked into opening a crafted metalink file, a remote attacker could overwrite files via directory traversal, which could eventually lead to arbitrary code execution.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A vulnerability has been found and corrected in kdenetwork4 :

Directory traversal vulnerability in the KGetMetalink::File::isValidNameAttr function in ui/metalinkcreator/metalinker.cpp in KGet in KDE SC 4.6.2 and earlier allows remote attackers to create arbitrary files via a .. (dot dot) in the name attribute of a file element in a metalink file. NOTE: this vulnerability exists because of an incomplete fix for CVE-2010-1000 (CVE-2011-1586).

Packages for 2009.0 are provided as of the Extended Maintenance Program. Please visit this link to learn more:
http://store.mandriva.com/product_info.php?cPath=149 products_id=490

The updated packages have been patched to correct this issue.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2011:0465 advisory.

  - kdenetwork: incomplete fix for CVE-2010-1000 (CVE-2011-1586)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
68260	Oracle Linux 6 : kdenetwork (ELSA-2011-0465)	Nessus	Oracle Linux Local Security Checks	critical
61024	Scientific Linux Security Update : kdenetwork on SL6.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	medium
55072	Ubuntu 9.10 / 10.04 LTS / 10.10 : kdenetwork vulnerability (USN-1114-1)	Nessus	Ubuntu Local Security Checks	medium
53628	Mandriva Linux Security Advisory : kdenetwork4 (MDVSA-2011:081)	Nessus	Mandriva Local Security Checks	medium
53526	RHEL 6 : kdenetwork (RHSA-2011:0465)	Nessus	Red Hat Local Security Checks	critical

Detections

Analytics

CVE-2011-1586

critical

Tenable Plugins

critical

medium

medium

medium

critical