Welcome to our website
To take full advantage of all features you need to login or register. Registration is completely free and takes only a few seconds.
KDE Security Advisory: Kate backup file permission leak
Posted by Philipp Esselbach on: 07/18/2005 11:12 AM [ Print | 0 comment(s) ]
KDE Security Advisory: Kate backup file permission leak
Original Release Date: 2005-07-18
URL: http://www.kde.org/info/security/advisory-20050718-1.txt
0. References
CVE CAN-2005-1920
https://bugs.kde.org/show_bug.cgi?id=103331
1. Systems affected:
All maintained versions of Kate and Kwrite as shipped with
KDE 3.2.x up to including 3.4.0. KDE 3.1.x and older and
KDE 3.4.1 and newer are not affected.
Original Release Date: 2005-07-18
URL: http://www.kde.org/info/security/advisory-20050718-1.txt
0. References
CVE CAN-2005-1920
https://bugs.kde.org/show_bug.cgi?id=103331
1. Systems affected:
All maintained versions of Kate and Kwrite as shipped with
KDE 3.2.x up to including 3.4.0. KDE 3.1.x and older and
KDE 3.4.1 and newer are not affected.
2. Overview:
Kate / Kwrite create a file backup before saving a modified
file. These backup files are created with default permissions,
even if the original file had more strict permissions set.
3. Impact:
Depending on the system security settings, backup files
might be readable by other users. Kate / Kwrite are
network transparent applications and therefore this
vulnerability might not be restricted to local users.
4. Solution:
Source code patches have been made available which fix these
vulnerabilities. Contact your OS vendor / binary package provider
for information about how to obtain updated binary packages.
5. Patch:
A patch for KDE 3.4.0 is available from
ftp://ftp.kde.org/pub/kde/security_patches :
50f7bc6d8cf4b7aaa65e4e8062fc46c9 post-3.4.0-kdelibs-kate.diff
A patch for KDE 3.3.x is available from
ftp://ftp.kde.org/pub/kde/security_patches :
138c3252883171d55ec24ed0318950fd post-3.3.2-kdelibs-kate.diff
A patch for KDE 3.2.x is available from
ftp://ftp.kde.org/pub/kde/security_patches :
56667c05f545e8c9711c35bf78497bfd post-3.2.3-kdelibs-kate.diff
Kate / Kwrite create a file backup before saving a modified
file. These backup files are created with default permissions,
even if the original file had more strict permissions set.
3. Impact:
Depending on the system security settings, backup files
might be readable by other users. Kate / Kwrite are
network transparent applications and therefore this
vulnerability might not be restricted to local users.
4. Solution:
Source code patches have been made available which fix these
vulnerabilities. Contact your OS vendor / binary package provider
for information about how to obtain updated binary packages.
5. Patch:
A patch for KDE 3.4.0 is available from
ftp://ftp.kde.org/pub/kde/security_patches :
50f7bc6d8cf4b7aaa65e4e8062fc46c9 post-3.4.0-kdelibs-kate.diff
A patch for KDE 3.3.x is available from
ftp://ftp.kde.org/pub/kde/security_patches :
138c3252883171d55ec24ed0318950fd post-3.3.2-kdelibs-kate.diff
A patch for KDE 3.2.x is available from
ftp://ftp.kde.org/pub/kde/security_patches :
56667c05f545e8c9711c35bf78497bfd post-3.2.3-kdelibs-kate.diff
