Three KDE security advisories have been issued today.

KDE Security Advisory: Local DCOP denial of service vulnerability Original Release Date: 20050316
URL: http://www.kde.org/info/security/advisory-20050316-1.txt

0. References
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0396


1. Systems affected:

All KDE version prior to KDE 3.4 on systems where multiple users have access.


2. Overview:

Sebastian Krahmer of the SUSE LINUX Security Team reported a local denial of service vulnerability in KDE's Desktop Communication Protocol (DCOP) daemon better known as dcopserver.

A local user can lock up the dcopserver of arbitrary other users on the same machine by stalling the DCOP authentication process.

Although it is not possible to by pass the authentication process this way, it can cause a significant reduction in desktop functionality for the affected users.

The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2005-0396 to this issue.



3. Impact:

A local user can lock up the dcopserver of arbitrary other users on the same machine. This can cause a significant reduction in desktop functionality for the affected users including, but not limited to, the inability to browse the internet and the inability to start new applications.


4. Solution:

Upgrade to KDE 3.4.

For older versions of KDE Source code patches have been made available which fix these vulnerabilities. Contact your OS vendor / binary package provider for information about how to obtain updated binary packages.


5. Patch:

A patch for KDE 3.1.x is available from
ftp://ftp.kde.org/pub/kde/security_patches

377c49d8224612fbf09f70f3c09d52f5 post-3.1.5-kdelibs-dcop.patch

A patch for KDE 3.2.x is available from
ftp://ftp.kde.org/pub/kde/security_patches

0948701bffb082c65784dc8a2b648ef0 post-3.2.3-kdelibs-dcop.patch

A patch for KDE 3.3.x is available from
ftp://ftp.kde.org/pub/kde/security_patches

7309e259ae1f29be08bbb70e580da3fb post-3.3.2-kdelibs-dcop.patch


6. Time line and credits:

21/02/2005 KDE Security informed by SUSE LINUX.
21/02/2005 Patches applied to KDE CVS.
02/03/2005 Vendors notified
16/03/2005 KDE Security Advisory released.


KDE Security Advisory: Konqueror International Domain Name Spoofing
Original Release Date: 20050316
URL: http://www.kde.org/info/security/advisory-20050316-2.txt

0. References
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0237
http://bugs.kde.org/show_bug.cgi?id=98788
http://lists.netsys.com/pipermail/full-disclosure/2005-February/031459.h
tml

http://lists.netsys.com/pipermail/full-disclosure/2005-February/031460.h
tml

http://www.shmoo.com/idn

http://www.shmoo.com/idn/homograph.txt

http://xforce.iss.net/xforce/xfdb/19236
http://secunia.com/advisories/14162/

1. Systems affected:

All KDE versions in the KDE 3.2.x and KDE 3.3.x series.


2. Overview:

Since version 3.2 KDE and it's webbrowser Konqueror have support for International Domain Names (IDN). Unfortunately this has made KDE vulnerable to a phishing technique known as a

Homograph attack.

IDN allows a website to use a wide range of international characters in its domain name. Unfortunately some of these characters have a strong resemblance to other characters, so called homographs. This makes it possible for a website to use a domain name that is technically different from another well known domain name, but has no or very little visual differences.

This lack of visual difference can be abused by attackers to trick users into visiting malicious websites that resemble a well known and trusted website in order to obtain personal information such as credit card details.

The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2005-0237 to this issue.

For KDE 3.4 KDE and the Konqueror webbrowser have adopted a whitelist of domains for which IDN is safe to use because the registrar for these domains has implemented anti-homographic character policies or otherwise limited the available set of characters to prevent spoofing.



3. Impact:

Users can be tricked into visiting a malicious website that resembles a well known and trusted website without getting any visual indication that this website differs from the one the user was expecting to visit.


4. Solution:

Upgrade to KDE 3.4.

For older versions of KDE Source code patches have been made available which fix these vulnerabilities. Contact your OS vendor / binary package provider for information about how to obtain updated binary packages.


5. Patch:

A patch for KDE 3.2.x is available from
ftp://ftp.kde.org/pub/kde/security_patches

611bad3cb9ae46ac35b907c7321da7aa post-3.2.3-kdelibs-idn.patch

A patch for KDE 3.3.x is available from
ftp://ftp.kde.org/pub/kde/security_patches

c87754dbbaca4cdfeb26626a908fab5f post-3.3.2-kdelibs-idn.patch

6. Time line and credits:

07/02/2005 Issue raised by Eric Johanson on full-disclosure
03/03/2005 Patches applied to KDE CVS.
04/03/2005 Vendors notified
16/03/2005 KDE Security Advisory released.


KDE Security Advisory: Insecure temporary file creation by dcopidlng
Original Release Date: 20050316
URL: http://www.kde.org/info/security/advisory-20050316-3.txt

0. References
http://bugs.kde.org/show_bug.cgi?id=97608
http://www.gentoo.org/security/en/glsa/glsa-200503-14.xml

http://bugs.gentoo.org/attachment.cgi?id=51120action=view
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0365

1. Systems affected:

All KDE versions in the KDE 3.2.x and KDE 3.3.x series. This problem only affects users who compile KDE or KDE applications themselves.

2. Overview:

The dcopidlng script is vulnerable to symlink attacks, potentially allowing a local user to overwrite arbitrary files of a user when the script is run on behalf of that user.

The dcopidlng script is run as part of the build process of KDE itself and may be used by the build process of third party KDE applications.

The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2005-0365 to this issue.



3. Impact:

The dcopidlng script is vulnerable to symlink attacks, potentially allowing a local user to overwrite arbitrary files of a user when that user compiles KDE or third party KDE applications that use the dcopidlng script as part of their build process.


4. Solution:

Upgrade to KDE 3.4.

For older versions of KDE Source code patches have been made available which fix these vulnerabilities.

Installed versions of dcopidlng can be patched manually as follows:

cd $(kde-config --expandvars --install exe)
patch lt; ~/post-3.2.3-kdelibs-dcopidlng.patch

5. Patch:

A patch for KDE 3.2.x is available from
ftp://ftp.kde.org/pub/kde/security_patches

43213bb9876704041af622ed2a6903ae post-3.2.3-kdelibs-dcopidlng.patch

A patch for KDE 3.3.x is available from
ftp://ftp.kde.org/pub/kde/security_patches

43213bb9876704041af622ed2a6903ae post-3.3.2-kdelibs-dcopidlng.patch


6. Time line and credits:

21/01/2005 Problem reported to bugs.kde.org by Davide Madrisan
21/01/2005 Patches applied to KDE CVS.
16/03/2005 KDE Security Advisory released.