Multiple vulnerabilities in KDE 2 and KDE 3.x through 3.0.5 do not quote certain parameters that are inserted into a shell command, which could allow remote attackers to execute arbitrary commands via (1) URLs, (2) filenames, or (3) e-mail addresses.

The KDE team discovered several vulnerabilities in the K Desktop Environment. In some instances KDE fails to properly quote parameters of instructions passed to a command shell for execution. These parameters may incorporate data such as URLs, filenames and e-mail addresses, and this data may be provided remotely to a victim in an e-mail, a webpage or files on a network filesystem or other untrusted source.

By carefully crafting such data an attacker might be able to execute arbitrary commands on a vulnerable system using the victim's account and privileges. The KDE Project is not aware of any existing exploits of these vulnerabilities. The patches also provide better safe guards and check data from untrusted sources more strictly in multiple places.

Multiple instances of improperly quoted shell command execution exist in KDE 2.x up to and including KDE 3.0.5. KDE fails to properly quote parameters of instructions passed to the shell for execution. These parameters may contain data such as filenames, URLs, email address, and so forth; this data may be provided remotely to a victim via email, web pages, files on a network filesystem, or other untrusted sources.

It is possible for arbitrary command execution on a vulnerable system with the privileges of the victim's account.

The code audit by the KDE team resulted in patches for KDE 2.2.2 and KDE 3; version 3.0.5a was released and the KDE team encourages the upgrade. The listed KDE2 packages have the KDE team's patches applied to provide the fixed code.

Update :

The SRPM for the new arts for Mandrake Linux 9.0 was not linked into the updates tree. This has been corrected.

A security issue has been found in KDE. This errata provides updates which resolve these issues.

KDE is a graphical desktop environment for the X Window System.

KDE fails in multiple places to properly quote URLs and filenames before passing them to a command shell. This could allow remote attackers to execute arbitrary commands through carefully crafted URLs, filenames, or email addresses.

Users of KDE are advised to install the updated packages which contain backported patches to correct this issue.

Please note that for the Itanium (IA64) architecture only, this update also fixes several other vulnerabilities. Details concerning these vulnerabilities can be found in advisory RHSA-2002:221 and correspond to CVE names CVE-2002-0970, CVE-2002-1151, CVE-2002-1247, and CVE-2002-1306.

ID	Name	Product	Family	Severity
15080	Debian DSA-243-1 : kdemultimedia - several vulnerabilities	Nessus	Debian Local Security Checks	high
15079	Debian DSA-242-1 : kdebase - several vulnerabilities	Nessus	Debian Local Security Checks	high
15078	Debian DSA-241-1 : kdeutils - several vulnerabilities	Nessus	Debian Local Security Checks	high
15077	Debian DSA-240-1 : kdegames - several vulnerabilities	Nessus	Debian Local Security Checks	high
15076	Debian DSA-239-1 : kdesdk - several vulnerabilities	Nessus	Debian Local Security Checks	high
15075	Debian DSA-238-1 : kdepim - several vulnerabilities	Nessus	Debian Local Security Checks	high
15074	Debian DSA-237-1 : kdenetwork - several vulnerabilities	Nessus	Debian Local Security Checks	high
15073	Debian DSA-236-1 : kdelibs - several vulnerabilities	Nessus	Debian Local Security Checks	high
15072	Debian DSA-235-1 : kdegraphics - several vulnerabilities	Nessus	Debian Local Security Checks	high
15071	Debian DSA-234-1 : kdeadmin - several vulnerabilities	Nessus	Debian Local Security Checks	high
13989	Mandrake Linux Security Advisory : kde (MDKSA-2003:004-1)	Nessus	Mandriva Local Security Checks	high
12347	RHEL 2.1 : kdelibs (RHSA-2003:003)	Nessus	Red Hat Local Security Checks	high

Detections

Analytics

CVE-2002-1393

critical

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high