KDE KDM læsning af vilkårlige filer - Advisories

Software Inspectors

	Scan Online

	Personal (PSI)

	Network (NSI 2.0)

Solutions For

	Security Professionals

	Security Vendors

Free Solutions For

	Open Communities

	Journalists & Media

Secunia Advisories

	Search

	Historic Advisories

	Listed By Product

	Listed By Vendor

	Statistics / Graphs

	Secunia Research

	Report Vulnerability

	About Advisories

Virus Information

	Chronological List

	Last 10 Virus Alerts

	About Virus Information

Secunia Customers

	Customer Area

KDE KDM læsning af vilkårlige filer

Secunia Advisory:	SA20602
Udsendt:	2006-06-15

Kritisk:	Mindre kritisk
Betydning:	Afsløring af følsomme oplysninger
Hvor:	Lokalt System
Løsning Status:	Producent Patch

Software:	KDE 3.x

CVE reference:	CVE-2006-2449 (Secunia mirror)

	Want to know the next time vulnerabilities are fixed in this product? - Companies can be alerted via email and SMS!

Beskrivelse: Der er rapporteret en sårbarhed i KDE, som kan udnyttes af ondsindede, lokale brugere til at få kendskab til følsom information. KDM tillader brugere at specificere sessions-typen for login, hvilket gemmes permanent i brugerens hjemmekatalog. Denne information læses på usikker vis af funktionen "ReadDmrc()" og kan udnyttes via symlink-angreb til at læse indholdet af vilkårlige filer på systemet. Sårbarheden berører KDE 3.2.0 til og med 3.5.3. Løsning: Installér patches. KDE 3.4.0 - KDE 3.5.3: ftp://ftp.kde.org/pub/kde/security_patches/post-3.5.0-kdebase-kdm.diff 9daecff07d57dabba35da247e752916a KDE 3.3.x: ftp://ftp.kde.org/pub/kde/security_patches/post-3.3.0-kdebase-kdm.diff f2e1424d97f2cd18674bef833274c5e3 KDE 3.2.x: ftp://ftp.kde.org/pub/kde/security_patches/post-3.2.0-kdebase-kdm.diff 8aa6b41cccca4216c6eb1cf705c2370a Rapporteret af / Kredit: Producenten krediterer Ludwig Nussel. Original Advisory: http://www.kde.org/info/security/advisory-20060614-1.txt



Please note: The information that this Secunia Advisory is based on comes from a third party unless stated otherwise. Secunia collects, validates, and verifies all vulnerability reports issued by security research groups, vendors, and others.

45 Relaterede Secunia Advisories, displaying 10

1. KDE KDM lokalt Denial of Service

2. KDE / KOffice "Stream.cc" flere sårbarheder

3. KDE KDM login password-kontrol sikkerhedsomgåelse

4. KDE og KOffice "StreamPredictor::StreamPredictor()" heltals-overflow

5. KMail "--status-fd" usikkert GnuPG-brug

6. Konqueror svaghed i HTML-fortolkning

7. KDE / KOffice PDF ugyldig "Tree Node" Denial of Service

8. KDE JPEG kfile-info EXIF Denial of Service svaghed

9. KDE kpdf splash billedhåndtering buffer overflow

10. KDE kjs UTF-8 indkodet URI buffer overflow

Vis alle relaterede advisories

Send Feedback to Secunia

Hvis du har ny information angående dette Secunia advisory eller et produkt i vores database, så send det venligst til os. Du kan sende det til os enten ved at bruge vores web formular eller ved at sende det til vuln@secunia.com. Ideer, foreslag og andet feedback er også meget velkommen.

Secunia PSI
Scan | Patch | Track
Free Download

Secunia Poll

Most Popular Advisories

1.	dotProject SQL Injection and Cross-Site Scripting

2.	HP TCP/IP Services for OpenVMS Finger Format String Vulnerability

3.	phpMyRealty "price_max" SQL Injection Vulnerability

4.	Novell eDirectory Multiple Vulnerabilities

5.	Blogn Cross-Site Scripting and Cross-Site Request Forgery

6.	Caudium "configvar" Insecure Temporary Files

7.	Sun Solaris Kernel Covert Channel Security Bypass

8.	Adium MSN SLP Message Integer Overflow Vulnerabilities

9.	IBM WebSphere Application Server for z/OS HTTP Server mod_proxy_ftp Vulnerability

10.	phpBB BBcode Script Insertion Vulnerability