The KDE Clock KCM policykit helper in kde-workspace before 4.11.14 and plasma-desktop before 5.1.1 allows local users to gain privileges via a crafted ntpUtility (ntp utility name) argument.

This update for kdebase4-workspace fixes the following issues :

  - CVE-2014-8651: Privilege escalation via KDE Clock KCM     helper when non-default polkit settings are used     (bsc#904625)

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201512-12 (KDE Systemsettings: Privilege escalation)

    KDE Systemsettings fails to properly validate user input before passing       it as argument in context of higher privilege.
  Impact :

    A local attacker could gain privileges via a crafted ntpUtility (ntp       utility name) argument.
  Workaround :

    Add a polkit rule to disable the org.kde.kcontrol.kcmclock.save action.

David Edmundson reports :

KDE workspace configuration module for setting the date and time has a helper program which runs as root for performing actions. This is secured with polkit.

This helper takes the name of the ntp utility to run as an argument.
This allows a hacker to run any arbitrary command as root under the guise of updating the time.

An application can gain root priveledges from an admin user with either misleading information or no interaction.

On some systems the user will be shown a prompt to change the time.
However, if the system has policykit-desktop-privileges installed, the datetime helper will be invoked by an admin user without any prompts.

New security fix release, privilege escalation issue, see also https://www.kde.org/info/security/advisory-20141106-1.txt

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

David Edmundson discovered that the KDE Clock KCM policykit helper did not properly guard against untrusted input. Under certain circumstances, a process running under the user's session could exploit this to run programs as the administrator.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
88559	SUSE SLED11 / SLES11 Security Update : kdebase4-workspace (SUSE-SU-2016:0303-1)	Nessus	SuSE Local Security Checks	high
87712	GLSA-201512-12 : KDE Systemsettings: Privilege escalation	Nessus	Gentoo Local Security Checks	high
79301	FreeBSD : kde-workspace -- privilege escalation (dafa13a8-6e9b-11e4-8ef7-5453ed2e2b49)	Nessus	FreeBSD Local Security Checks	high
79265	Fedora 21 : kde-workspace-4.11.14-1.fc21 (2014-14895)	Nessus	Fedora Local Security Checks	high
79264	Fedora 19 : kde-workspace-4.11.14-1.fc19 (2014-14865)	Nessus	Fedora Local Security Checks	high
79263	Fedora 20 : kde-workspace-4.11.14-1.fc20 (2014-14813)	Nessus	Fedora Local Security Checks	high
79122	Ubuntu 12.04 LTS : kde-workspace vulnerabilities (USN-2402-1)	Nessus	Ubuntu Local Security Checks	high

Detections

Analytics

CVE-2014-8651

high

Tenable Plugins

high

high

high

high

high

high

high