KDM in KDE 3.1.3 and earlier uses a weak session cookie generation algorithm that does not provide 128 bits of entropy, which allows attackers to guess session cookies via brute force methods and gain access to the user session.

Two vulnerabilities were discovered in kdebase :

  - CAN-2003-0690 :
    KDM in KDE 3.1.3 and earlier does not verify whether the     pam_setcred function call succeeds, which may allow     attackers to gain root privileges by triggering error     conditions within PAM modules, as demonstrated in     certain configurations of the MIT pam_krb5 module.

  - CAN-2003-0692 :

    KDM in KDE 3.1.3 and earlier uses a weak session cookie     generation algorithm that does not provide 128 bits of     entropy, which allows attackers to guess session cookies     via brute-force methods and gain access to the user     session.

These vulnerabilities are described in the following security advisory from KDE :

A vulnerability was discovered in all versions of KDE 2.2.0 up to and including 3.1.3. KDM does not check for successful completion of the pam_setcred() call and in the case of error conditions in the installed PAM modules, KDM may grant local root access to any user with valid login credentials. It has been reported to the KDE team that a certain configuration of the MIT pam_krb5 module can result in a failing pam_setcred() call which leaves the session alive and would provide root access to any regular user. It is also possible that this vulnerability can likewise be exploited with other PAM modules in a similar manner.

Another vulnerability was discovered in kdm where the cookie session generating algorithm was considered too weak to supply a full 128 bits of entropy. This allowed unauthorized users to brute-force the session cookie.

mdkkdm, a specialized version of kdm, is likewise vulnerable to these problems and has been patched as well.

Updated KDE packages that resolve a local security issue with KDM PAM support and weak session cookie generation are now available.

KDE is a graphical desktop environment for the X Window System.

KDE between versions 2.2.0 and 3.1.3 inclusive contain a bug in the KDE Display Manager (KDM) when checking the result of a pam_setcred() call. If an error condition is triggered by the installed PAM modules, KDM might grant local root access to any user with valid login credentials.

It has been reported that one way to trigger this bug is by having a certain configuration of the MIT pam_krb5 module that leaves a session alive and gives root access to a regular user. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2003-0690 to this issue.

In addition, the session cookie generation algorithm used by KDM was considered too weak to supply a full 128 bits of entropy. This could make it possible for non-authorized users, who are able to bypass any host restrictions, to brute-force the session cookie and gain acess to the current session. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2003-0692 to this issue.

Users of KDE are advised to upgrade to these erratum packages, which contain security patches correcting these issues.

Red Hat would like to thank the KDE team for notifying us of this issue and providing the security patches.

ID	Name	Product	Family	Severity
15225	Debian DSA-388-1 : kdebase - several vulnerabilities	Nessus	Debian Local Security Checks	critical
14073	Mandrake Linux Security Advisory : kdebase (MDKSA-2003:091)	Nessus	Mandriva Local Security Checks	critical
12419	RHEL 2.1 : kdebase (RHSA-2003:270)	Nessus	Red Hat Local Security Checks	critical

Detections

Analytics

CVE-2003-0692

critical

Tenable Plugins

critical

critical

critical