Detections
Analytics

Fedora 29 : kdelibs3 (2019-9f2ee52c88)

high Nessus Plugin ID 127940

Language:

Synopsis

The remote Fedora host is missing a security update.

Description

This update fixes **CVE-2019-14744 (kconfig arbitrary shell code execution)** in the KDE 3 compatibility version of kdelibs used by legacy KDE 3 applications.

The full list of fixes in this `kdelibs3` build :

 - fixes **CVE-2019-14744** - `kconfig`: malicious `.desktop` files (and others) would execute code.
 KConfig had a well-meaning feature that allowed configuration files to execute arbitrary shell commands.
 Unfortunately, this could be abused by untrusted `.desktop` files to execute arbitrary code as the target user, without the user even running the `.desktop` file.
 Therefore, this update removes that ill-fated feature.
 (Backported by Kevin Kofler from upstream: `kf5-kconfig` fix by David Faure, `kdelibs` 4 backport by Kai Uwe Broulik.)

 - adds native support for **xdg-user-dirs** for *Desktop* and *Documents*, without shelling out to `xdg-user-dir` from the config file. This is needed due to the above security fix. (This feature was previously implemented in the Fedora `kde-settings` by shelling out to `xdg-user-dir` from the config file using the KConfig feature removed above.) (Backported by Kevin Kofler from Trinity Desktop / Timothy Pearson.)

 - fixes a **KJS double-free** that could crash legacy KDE 3 applications such as Quanta Plus when trying to execute JavaScript. (Backported by OpenSUSE / Wolfgang Bauer from Trinity Desktop / Timothy Pearson.)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Solution

Update the affected kdelibs3 package.

See Also

https://bodhi.fedoraproject.org/updates/FEDORA-2019-9f2ee52c88

Plugin Details

Severity: High

ID: 127940

File Name: fedora_2019-9f2ee52c88.nasl

Version: 1.3

Type: local

Agent: unix

Published: 8/20/2019

Updated: 1/2/2020

Supported Sensors: Frictionless Assessment Agent, Nessus Agent, Agentless Assessment, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 6.7

CVSS v2

Risk Factor: Medium

Base Score: 5.1

Temporal Score: 3.8

Vector: CVSS2#AV:N/AC:H/Au:N/C:P/I:P/A:P

CVSS v3

Risk Factor: High

Base Score: 7.8

Temporal Score: 6.8

Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: p-cpe:/a:fedoraproject:fedora:kdelibs3, cpe:/o:fedoraproject:fedora:29

Required KB Items: Host/local_checks_enabled, Host/RedHat/release, Host/RedHat/rpm-list

Exploit Ease: No known exploits are available

Patch Publication Date: 8/19/2019

Vulnerability Publication Date: 8/7/2019

Reference Information

CVE: CVE-2019-14744