Debian alert: New kdesdk packages fix several vulnerabilities

Posted by dave on Jan 23, 2003 6:56 AM EDT
Mailing list		Mail this story
Print this story

The KDE team discovered several vulnerabilities in the K Desktop Environment. In some instances KDE fails to properly quote parameters of instructions passed to a command shell for execution. These parameters may incorporate data such as URLs, filenames and e-mail addresses, and this data may be provided remotely to a victim in an e-mail, a webpage or files on a network filesystem or other untrusted source. 

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- --------------------------------------------------------------------------
Debian Security Advisory DSA 239-1                     security@debian.org
http://www.debian.org/security/                             Martin Schulze
January 23rd, 2003                      http://www.debian.org/security/faq
- --------------------------------------------------------------------------

Package        : kdesdk
Vulnerability  : several
Problem-type   : local, remote
Debian-specific: no
CVE Id         : CAN-2002-1393

The KDE team discovered several vulnerabilities in the K Desktop
Environment.  In some instances KDE fails to properly quote parameters
of instructions passed to a command shell for execution.  These
parameters may incorporate data such as URLs, filenames and e-mail
addresses, and this data may be provided remotely to a victim in an
e-mail, a webpage or files on a network filesystem or other untrusted
source.

By carefully crafting such data an attacker might be able to execute
arbitary commands on a vulnerable sytem using the victim's account and
privileges.  The KDE Project is not aware of any existing exploits of
these vulnerabilities.  The patches also provide better safe guards
and check data from untrusted sources more strictly in multiple
places.

For the current stable distribution (woody), these problems have been fixed
in version 2.2.2-3.2.

The old stable distribution (potato) does not contain KDE packages.

For the unstable distribution (sid), these problems will most probably
not be fixed but new packages for KDE 3.1 for sid are expected for
this year.

We recommend that you upgrade your KDE packages.


Upgrade Instructions
- --------------------

wget url
        will fetch the file for you
dpkg -i file.deb
        will install the referenced file.

If you are using the apt-get package manager, use the line for
sources.list as given below:

apt-get update
        will update the internal database
apt-get upgrade
        will install corrected packages

You may use an automated update by adding the resources from the
footer to the proper configuration.


Debian GNU/Linux 3.0 alias woody
- --------------------------------

  Source archives:

    http://security.debian.org/pool/updates/main/k/kdesdk/kdesdk_2.2.2-3.2.dsc
      Size/MD5 checksum:      809 1e72a255b00079ba8e293a4ceb1c8eb3
    http://security.debian.org/pool/updates/main/k/kdesdk/kdesdk_2.2.2-3.2.diff.gz
      Size/MD5 checksum:     2645 1f41391569ee52599dc843687a03181e
    http://security.debian.org/pool/updates/main/k/kdesdk/kdesdk_2.2.2.orig.tar.gz
      Size/MD5 checksum:  1360120 27bc6f7baf89e63fc6913772769920df

  Architecture independent components:

    http://security.debian.org/pool/updates/main/k/kdesdk/kapptemplate_2.2.2-3.2_all.deb
      Size/MD5 checksum:   250626 a8e193b6c246f9038bd0b1634e8628c0
    http://security.debian.org/pool/updates/main/k/kdesdk/kdepalettes_2.2.2-3.2_all.deb
      Size/MD5 checksum:     5836 d426f27006ee16b366e7aea58535ab3f
    http://security.debian.org/pool/updates/main/k/kdesdk/kdesdk-doc_2.2.2-3.2_all.deb
      Size/MD5 checksum:   126968 30f7976922e912f7ced3b4c5252241df
    http://security.debian.org/pool/updates/main/k/kdesdk/kdesdk-scripts_2.2.2-3.2_all.deb
      Size/MD5 checksum:    66716 1c1b8276651620280b31cf892a10a6e7

  Alpha architecture:

    http://security.debian.org/pool/updates/main/k/kdesdk/kbabel_2.2.2-3.2_alpha.deb
      Size/MD5 checksum:   859876 2d1f134832246f016708c9b5869b2e6b
    http://security.debian.org/pool/updates/main/k/kdesdk/kbabel-dev_2.2.2-3.2_alpha.deb
      Size/MD5 checksum:    21394 4bccd516498a581fae81f4f0a86a91c9
    http://security.debian.org/pool/updates/main/k/kdesdk/kdesdk_2.2.2-3.2_alpha.deb
      Size/MD5 checksum:     4812 8003ab13861e310bcc912fccc8fcd2ca
    http://security.debian.org/pool/updates/main/k/kdesdk/kexample_2.2.2-3.2_alpha.deb
      Size/MD5 checksum:    27588 891cb9ed18b7fcbf0dbcd6d81777d04a
    http://security.debian.org/pool/updates/main/k/kdesdk/kmtrace_2.2.2-3.2_alpha.deb
      Size/MD5 checksum:    63782 972cec3713037b485e993dddf0b4d38a
    http://security.debian.org/pool/updates/main/k/kdesdk/kspy_2.2.2-3.2_alpha.deb
      Size/MD5 checksum:    31528 de61d755227fbc982af96b3d1823f238
    http://security.debian.org/pool/updates/main/k/kdesdk/kstartperf_2.2.2-3.2_alpha.deb
      Size/MD5 checksum:    14632 528754318b469f61e61bd239576c629c
    http://security.debian.org/pool/updates/main/k/kdesdk/poxml_2.2.2-3.2_alpha.deb
      Size/MD5 checksum:   646068 8215138bec95fce13579ddeb57835363

  ARM architecture:

    http://security.debian.org/pool/updates/main/k/kdesdk/kbabel_2.2.2-3.2_arm.deb
      Size/MD5 checksum:   774294 7be484e4e531bada235675670656f7ad
    http://security.debian.org/pool/updates/main/k/kdesdk/kbabel-dev_2.2.2-3.2_arm.deb
      Size/MD5 checksum:    21392 a106a49607929471e8d0fbfda42b7302
    http://security.debian.org/pool/updates/main/k/kdesdk/kdesdk_2.2.2-3.2_arm.deb
      Size/MD5 checksum:     4814 c659f7dba60b8d00ff8f6e9c0d7f1d87
    http://security.debian.org/pool/updates/main/k/kdesdk/kexample_2.2.2-3.2_arm.deb
      Size/MD5 checksum:    25996 2fc418708a8c880c5aecc45cbde1c2ec
    http://security.debian.org/pool/updates/main/k/kdesdk/kmtrace_2.2.2-3.2_arm.deb
      Size/MD5 checksum:    58904 34211e1af64b8a80aa39149480f07c74
    http://security.debian.org/pool/updates/main/k/kdesdk/kspy_2.2.2-3.2_arm.deb
      Size/MD5 checksum:    28198 c4f819f1d31987346a979fab5fc8ec2e
    http://security.debian.org/pool/updates/main/k/kdesdk/kstartperf_2.2.2-3.2_arm.deb
      Size/MD5 checksum:    13276 e1a80773b018de47fa2a4247743cb5e5
    http://security.debian.org/pool/updates/main/k/kdesdk/poxml_2.2.2-3.2_arm.deb
      Size/MD5 checksum:   823442 679a0cc8b4716ea12a3431af11c16697

  Intel IA-32 architecture:

    http://security.debian.org/pool/updates/main/k/kdesdk/kbabel_2.2.2-3.2_i386.deb
      Size/MD5 checksum:   771636 398d372af4149eba47689f9b36db7780
    http://security.debian.org/pool/updates/main/k/kdesdk/kbabel-dev_2.2.2-3.2_i386.deb
      Size/MD5 checksum:    21390 4af236cb7cbfb97be9650a5bb0912247
    http://security.debian.org/pool/updates/main/k/kdesdk/kdesdk_2.2.2-3.2_i386.deb
      Size/MD5 checksum:     4812 c3b559f9f7429653181503c179f1f0e4
    http://security.debian.org/pool/updates/main/k/kdesdk/kexample_2.2.2-3.2_i386.deb
      Size/MD5 checksum:    27030 ea6665b84e3e12bf1ea11ce30e086d8a
    http://security.debian.org/pool/updates/main/k/kdesdk/kmtrace_2.2.2-3.2_i386.deb
      Size/MD5 checksum:    52800 068d88ee6551f11a48f51d3973787a39
    http://security.debian.org/pool/updates/main/k/kdesdk/kspy_2.2.2-3.2_i386.deb
      Size/MD5 checksum:    26852 dca10d6aa7f98c468e983e60b1f4b452
    http://security.debian.org/pool/updates/main/k/kdesdk/kstartperf_2.2.2-3.2_i386.deb
      Size/MD5 checksum:    13280 8611af32043773a83bb1cf59bf45c859
    http://security.debian.org/pool/updates/main/k/kdesdk/poxml_2.2.2-3.2_i386.deb
      Size/MD5 checksum:   646918 8cab3553cb420581e5d5d61dc6bb6c32

  Intel IA-64 architecture:

    http://security.debian.org/pool/updates/main/k/kdesdk/kbabel_2.2.2-3.2_ia64.deb
      Size/MD5 checksum:  1081164 adc303bb20b873e1d1111e4bff4b0035
    http://security.debian.org/pool/updates/main/k/kdesdk/kbabel-dev_2.2.2-3.2_ia64.deb
      Size/MD5 checksum:    21398 6adf6c79dcbf70931c1865b649a7cdcb
    http://security.debian.org/pool/updates/main/k/kdesdk/kdesdk_2.2.2-3.2_ia64.deb
      Size/MD5 checksum:     4812 3cc47238e4fc2a13f2f54e617e646d00
    http://security.debian.org/pool/updates/main/k/kdesdk/kexample_2.2.2-3.2_ia64.deb
      Size/MD5 checksum:    29356 b121017c5ed894da3aa55ba8e39c2ba3
    http://security.debian.org/pool/updates/main/k/kdesdk/kmtrace_2.2.2-3.2_ia64.deb
      Size/MD5 checksum:    82626 123f528b9eed10394461baa30243ee51
    http://security.debian.org/pool/updates/main/k/kdesdk/kspy_2.2.2-3.2_ia64.deb
      Size/MD5 checksum:    33162 26c22978b33eeda9cae0d15641302a1e
    http://security.debian.org/pool/updates/main/k/kdesdk/kstartperf_2.2.2-3.2_ia64.deb
      Size/MD5 checksum:    15300 d6b7c27627086e1b5cef53959af9731c
    http://security.debian.org/pool/updates/main/k/kdesdk/poxml_2.2.2-3.2_ia64.deb
      Size/MD5 checksum:   925860 d4ce81bf2af95fe33100df103c21dc7e

  HP Precision architecture:

    http://security.debian.org/pool/updates/main/k/kdesdk/kbabel_2.2.2-3.2_hppa.deb
      Size/MD5 checksum:   889318 bcff53bd4619d49193abe277c09d1506
    http://security.debian.org/pool/updates/main/k/kdesdk/kbabel-dev_2.2.2-3.2_hppa.deb
      Size/MD5 checksum:    21398 5ce6c4922f8c176b969a9c1a96bee298
    http://security.debian.org/pool/updates/main/k/kdesdk/kdesdk_2.2.2-3.2_hppa.deb
      Size/MD5 checksum:     4810 5ab1aa6a25c4939e9c9c8abe65a17d7c
    http://security.debian.org/pool/updates/main/k/kdesdk/kexample_2.2.2-3.2_hppa.deb
      Size/MD5 checksum:    28136 159b6cc8977f5b45cad85e97e9ce117c
    http://security.debian.org/pool/updates/main/k/kdesdk/kmtrace_2.2.2-3.2_hppa.deb
      Size/MD5 checksum:    66134 ac364b2798f4b2307a51529d1bb600db
    http://security.debian.org/pool/updates/main/k/kdesdk/kspy_2.2.2-3.2_hppa.deb
      Size/MD5 checksum:    32966 22ee0f939f8922c25517823214b193bf
    http://security.debian.org/pool/updates/main/k/kdesdk/kstartperf_2.2.2-3.2_hppa.deb
      Size/MD5 checksum:    14020 c16c6dde35ed450d4142cd06527481cd
    http://security.debian.org/pool/updates/main/k/kdesdk/poxml_2.2.2-3.2_hppa.deb
      Size/MD5 checksum:   606434 f71003608b1e050c050069f4d17c226a

  Motorola 680x0 architecture:

    http://security.debian.org/pool/updates/main/k/kdesdk/kbabel_2.2.2-3.2_m68k.deb
      Size/MD5 checksum:   755554 8a29c63753913e33ebde86dcf2d6d392
    http://security.debian.org/pool/updates/main/k/kdesdk/kbabel-dev_2.2.2-3.2_m68k.deb
      Size/MD5 checksum:    21412 da1079065eebd18a353a66a61cd4dee1
    http://security.debian.org/pool/updates/main/k/kdesdk/kdesdk_2.2.2-3.2_m68k.deb
      Size/MD5 checksum:     4824 8f8a296e9cb9809992ee775afbf3fd18
    http://security.debian.org/pool/updates/main/k/kdesdk/kexample_2.2.2-3.2_m68k.deb
      Size/MD5 checksum:    27516 5d50b2f558e0c762ee5c2dfc99fa7f6e
    http://security.debian.org/pool/updates/main/k/kdesdk/kmtrace_2.2.2-3.2_m68k.deb
      Size/MD5 checksum:    49072 fbe18a9d85c5f8412b73d6b525fc9739
    http://security.debian.org/pool/updates/main/k/kdesdk/kspy_2.2.2-3.2_m68k.deb
      Size/MD5 checksum:    30292 4bf09fa1bd8cc6de9c16159ecd3ae589
    http://security.debian.org/pool/updates/main/k/kdesdk/kstartperf_2.2.2-3.2_m68k.deb
      Size/MD5 checksum:    13366 438135879b2780246d418743f9a9fd3d
    http://security.debian.org/pool/updates/main/k/kdesdk/poxml_2.2.2-3.2_m68k.deb
      Size/MD5 checksum:   572830 43978d2e9e5361e5961e8ff54063faa6

  Big endian MIPS architecture:

    http://security.debian.org/pool/updates/main/k/kdesdk/kbabel_2.2.2-3.2_mips.deb
      Size/MD5 checksum:   732348 3a20102bd3df1b16a1c383925ff280ea
    http://security.debian.org/pool/updates/main/k/kdesdk/kbabel-dev_2.2.2-3.2_mips.deb
      Size/MD5 checksum:    21404 c57eb0e4b427557ea08331a1fad33779
    http://security.debian.org/pool/updates/main/k/kdesdk/kdesdk_2.2.2-3.2_mips.deb
      Size/MD5 checksum:     4816 7df152e52a3794b317ecdb434bfd8295
    http://security.debian.org/pool/updates/main/k/kdesdk/kexample_2.2.2-3.2_mips.deb
      Size/MD5 checksum:    25996 4b6716a1024718ab305040fe445794c6
    http://security.debian.org/pool/updates/main/k/kdesdk/kmtrace_2.2.2-3.2_mips.deb
      Size/MD5 checksum:    56908 21b6f8a8f328b37485b4403d0c1b63d3
    http://security.debian.org/pool/updates/main/k/kdesdk/kspy_2.2.2-3.2_mips.deb
      Size/MD5 checksum:    26984 7fb1700bf00e7c136bc541670a6e21a8
    http://security.debian.org/pool/updates/main/k/kdesdk/kstartperf_2.2.2-3.2_mips.deb
      Size/MD5 checksum:    13490 d0ff206692c05683bfc25b8628359430
    http://security.debian.org/pool/updates/main/k/kdesdk/poxml_2.2.2-3.2_mips.deb
      Size/MD5 checksum:   501868 c1b11ebc04ab12231740ba85ff34fab0

  Little endian MIPS architecture:

    http://security.debian.org/pool/updates/main/k/kdesdk/kbabel_2.2.2-3.2_mipsel.deb
      Size/MD5 checksum:   725606 67c6d21460d34f18dabe4b4541da49f0
    http://security.debian.org/pool/updates/main/k/kdesdk/kbabel-dev_2.2.2-3.2_mipsel.deb
      Size/MD5 checksum:    21398 373e5e32b5afc536b654006206925d59
    http://security.debian.org/pool/updates/main/k/kdesdk/kdesdk_2.2.2-3.2_mipsel.deb
      Size/MD5 checksum:     4814 537b6a8c5f982f61a299c429a8e66487
    http://security.debian.org/pool/updates/main/k/kdesdk/kexample_2.2.2-3.2_mipsel.deb
      Size/MD5 checksum:    25926 5c5e4027ef6ca161d15c0088f8ae73e0
    http://security.debian.org/pool/updates/main/k/kdesdk/kmtrace_2.2.2-3.2_mipsel.deb
      Size/MD5 checksum:    56948 2077d42240aa305ceadd620744e4a3af
    http://security.debian.org/pool/updates/main/k/kdesdk/kspy_2.2.2-3.2_mipsel.deb
      Size/MD5 checksum:    26842 3008905abfba7904d5df4fd55a416bdc
    http://security.debian.org/pool/updates/main/k/kdesdk/kstartperf_2.2.2-3.2_mipsel.deb
      Size/MD5 checksum:    13456 1daf24ffefc3abe4bc68fc0b86a8056f
    http://security.debian.org/pool/updates/main/k/kdesdk/poxml_2.2.2-3.2_mipsel.deb
      Size/MD5 checksum:   485800 1e801b8a53fcba4d804a1991ef33f598

  PowerPC architecture:

    http://security.debian.org/pool/updates/main/k/kdesdk/kbabel_2.2.2-3.2_powerpc.deb
      Size/MD5 checksum:   776788 c45a2dca8dcb7cbd34f4d9a19dc4891f
    http://security.debian.org/pool/updates/main/k/kdesdk/kbabel-dev_2.2.2-3.2_powerpc.deb
      Size/MD5 checksum:    21396 0c42f08dd63079eb61dae050629678df
    http://security.debian.org/pool/updates/main/k/kdesdk/kdesdk_2.2.2-3.2_powerpc.deb
      Size/MD5 checksum:     4814 9311209a5ea526e9f24f5c9311865f7b
    http://security.debian.org/pool/updates/main/k/kdesdk/kexample_2.2.2-3.2_powerpc.deb
      Size/MD5 checksum:    25568 eb202cb0741f3d6dac8c56a5364513b3
    http://security.debian.org/pool/updates/main/k/kdesdk/kmtrace_2.2.2-3.2_powerpc.deb
      Size/MD5 checksum:    55920 deccf7c64b24a5d4cd133a03fd0965d1
    http://security.debian.org/pool/updates/main/k/kdesdk/kspy_2.2.2-3.2_powerpc.deb
      Size/MD5 checksum:    27254 0768e4faa8088feb0b0ae96d077f9a73
    http://security.debian.org/pool/updates/main/k/kdesdk/kstartperf_2.2.2-3.2_powerpc.deb
      Size/MD5 checksum:    13480 19e5c0ef57434c581e6609feac1d402e
    http://security.debian.org/pool/updates/main/k/kdesdk/poxml_2.2.2-3.2_powerpc.deb
      Size/MD5 checksum:   597628 ef1f2ff7a37f6a260325aa14156a6293

  IBM S/390 architecture:

    http://security.debian.org/pool/updates/main/k/kdesdk/kbabel_2.2.2-3.2_s390.deb
      Size/MD5 checksum:   786632 823b69607fc4b1a29544308a46b14da5
    http://security.debian.org/pool/updates/main/k/kdesdk/kbabel-dev_2.2.2-3.2_s390.deb
      Size/MD5 checksum:    21396 71a5686e9469e65219adfb5e71b25430
    http://security.debian.org/pool/updates/main/k/kdesdk/kdesdk_2.2.2-3.2_s390.deb
      Size/MD5 checksum:     4812 7bbff9c4a6052f2233add2f024a32357
    http://security.debian.org/pool/updates/main/k/kdesdk/kexample_2.2.2-3.2_s390.deb
      Size/MD5 checksum:    28408 81d705f49ed63cd6c0e06e2d54aba3ab
    http://security.debian.org/pool/updates/main/k/kdesdk/kmtrace_2.2.2-3.2_s390.deb
      Size/MD5 checksum:    56080 e173c5fa1a60090fc88fbd55810f6713
    http://security.debian.org/pool/updates/main/k/kdesdk/kspy_2.2.2-3.2_s390.deb
      Size/MD5 checksum:    28160 e02c2b090c006177af9f79554496d96a
    http://security.debian.org/pool/updates/main/k/kdesdk/kstartperf_2.2.2-3.2_s390.deb
      Size/MD5 checksum:    13626 6cb99ec8320414ff2aae1a021be21038
    http://security.debian.org/pool/updates/main/k/kdesdk/poxml_2.2.2-3.2_s390.deb
      Size/MD5 checksum:   498292 90c93d77364f16bf6bbc6df35bd3f7af

  Sun Sparc architecture:

    http://security.debian.org/pool/updates/main/k/kdesdk/kbabel_2.2.2-3.2_sparc.deb
      Size/MD5 checksum:   782502 4f23c31dd8961b0c14098cb35a14a14c
    http://security.debian.org/pool/updates/main/k/kdesdk/kbabel-dev_2.2.2-3.2_sparc.deb
      Size/MD5 checksum:    21394 e59e9cf5957993d613e0bfc168e2895b
    http://security.debian.org/pool/updates/main/k/kdesdk/kdesdk_2.2.2-3.2_sparc.deb
      Size/MD5 checksum:     4810 96cc1ed9708a39cd1ee98093c4af5aab
    http://security.debian.org/pool/updates/main/k/kdesdk/kexample_2.2.2-3.2_sparc.deb
      Size/MD5 checksum:    26404 d6ddf3c6847c1968f763a5803cad36de
    http://security.debian.org/pool/updates/main/k/kdesdk/kmtrace_2.2.2-3.2_sparc.deb
      Size/MD5 checksum:    55730 697a73daa3bf53170c03b0c2b56ddce4
    http://security.debian.org/pool/updates/main/k/kdesdk/kspy_2.2.2-3.2_sparc.deb
      Size/MD5 checksum:    29364 7a6926422194514084fd3637686313a1
    http://security.debian.org/pool/updates/main/k/kdesdk/kstartperf_2.2.2-3.2_sparc.deb
      Size/MD5 checksum:    13378 69e08fa7cabf50fa2e97f16a8af16192
    http://security.debian.org/pool/updates/main/k/kdesdk/poxml_2.2.2-3.2_sparc.deb
      Size/MD5 checksum:   584010 04dd30e9894dff1b2bbaf709ae6e13e2


  These files will probably be moved into the stable distribution on
  its next revision.

- ---------------------------------------------------------------------------------
For apt-get: deb http://security.debian.org/ stable/updates main
For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main
Mailing list: debian-security-announce@lists.debian.org
Package info: `apt-cache show <pkg>' and http://packages.debian.org/<pkg>

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (GNU/Linux)

iD8DBQE+MBC8W5ql+IAeqTIRApYDAKC5tA4+xAog6VT2h4oo3haYcc/3JwCaAhax
YdYE+ygjcd5zdYM+ykq6cmM=
=kNcy
-----END PGP SIGNATURE-----

  Nav
» Read more about: Story Type: Security; Groups: Debian

« Return to the newswire homepage

This topic does not have any threads posted yet!

You cannot post until you login.