Ilja van Sprundel has reported a vulnerability in kcheckpass, which potentially can be exploited by malicious, local users to gain escalated privileges.

The vulnerability is caused due to the insecure creation of the lock file in "/var/lock" by kcheckpass.c. This can be exploited via symlink attacks to create or overwrite arbitrary files with the privileges of the user running the affected application.

Successful exploitation requires that the directory "/var/lock" is writable.

The vulnerability affects KDE versions 3.2.0 through 3.4.2.

Solution
Apply patch (KDE 3.4.2):
Further details available to Secunia VIM customers

Provided and/or discovered by
Ilja van Sprundel, Suresec.

Changelog
Further details available to Secunia VIM customers

Original Advisory
KDE.org:
http://www.kde.org/info/security/advisory-20050905-1.txt

Suresec:
http://www.suresec.org/advisories/adv6.pdf

Deep Links
Links available to Secunia VIM customers