Race condition in backend/ctrl.c in KDM in KDE Software Compilation (SC) 2.2.0 through 4.4.2 allows local users to change the permissions of arbitrary files, and consequently gain privileges, by blocking the removal of a certain directory that contains a control socket, related to improper interaction with ksm.

The remote host is affected by the vulnerability described in GLSA-201412-08 (Multiple packages, Multiple vulnerabilities fixed in 2010)

    Vulnerabilities have been discovered in the packages listed below.
      Please review the CVE identifiers in the Reference section for details.
      Insight       Perl Tk Module       Source-Navigator       Tk       Partimage       Mlmmj       acl       Xinit       gzip       ncompress       liblzw       splashutils       GNU M4       KDE Display Manager       GTK+       KGet       dvipng       Beanstalk       Policy Mount       pam_krb5       GNU gv       LFTP       Uzbl       Slim       Bitdefender Console       iputils       DVBStreamer   Impact :

    A context-dependent attacker may be able to gain escalated privileges,       execute arbitrary code, cause Denial of Service, obtain sensitive       information, or otherwise bypass security restrictions.
  Workaround :

    There are no known workarounds at this time.

The remote Oracle Linux 5 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2010-0348 advisory.

    [6:3.5.4-21.0.1.el5_5.1]
    - Update definition of KONQUEROR_VERSION in specfile

    [6:3.5.4-21.1]
    - Resolves: #570622, CVE-2010-0436 kdm privilege escalation flaw

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

A privilege escalation flaw was found in the KDE Display Manager (KDM). A local user with console access could trigger a race condition, possibly resulting in the permissions of an arbitrary file being set to world-writable, allowing privilege escalation.
(CVE-2010-0436)

The system should be rebooted for this update to take effect. After the reboot, administrators should manually remove all leftover user-owned dmctl-* directories in '/var/run/xdmctl/'.

New kdebase-workspace packages are available for Slackware 13.0 and
-current to fix a security issue with KDM.

The KDE display manager kdm contains a race condition which allows local attackers to make arbitrary files orld writable. CVE-2010-0436 has been assigned to this issue.

This update set updates the KDE Software Compilation (KDE SC) to KDE SC 4.4.3, which has a number of improvements: * Numerous fixes in Konsole, KDE's terminal emulator, among them two possible crashers in session management * Flash plugin support in KHTML has been enhanced to work with newest Youtube skins * Case-sensitivity in renaming fixes in KIO, KDE's network-transparent I/O library

  - Hiding the mouse cursor in some special cases in     presentation mode and two possible crashers have been     fixed and more bugfixes and translation updates. See     http://kde.org/announcements/announce-4.4.3.php for more     information. In addition, the security issues     CVE-2010-1000 and CVE-2010-1511 (improper sanitization     of metalink attribute for downloading files) in KGet     have been fixed, and Kppp now prompts for the root     password instead of failing with a cryptic error when     run as a regular user.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This build includes * a couple of small powerdevil patches (see kde bugs 221637, 221637), * fix icon name in plasma-konsole patch: use XDG icon instead of kappfinder one, * initial attempts at kdm/plymouth integration, * upstream kdm security fix for CVE-2010-0436

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update set updates the KDE Software Compilation (KDE SC) to KDE SC 4.4.2, which has a number of improvements: * Possible crashes in Plasma, Dolphin and Okular have been fixed * The Microblog applet now shows the correct time in the timeline * The audioplayer KRunner plugin has been fixed to not freeze the KRunner UI anymore and more bugfixes and translation updates. See http://kde.org/announcements/announce-4.4.2.php for more information.
* a couple of small powerdevil patches (see kde bugs 221637, 221637),
* upstream kdm security fix for CVE-2010-0436 Also included are the bugfix releases SIP 4.10.1:
http://www.riverbankcomputing.co.uk/static/Downloads/sip4/ChangeLog and PyQt4 4.7.2:
http://www.riverbankcomputing.co.uk/static/Downloads/PyQt4/ChangeLog

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated kdebase packages that fix one security issue are now available for Red Hat Enterprise Linux 4 and 5.

The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

The K Desktop Environment (KDE) is a graphical desktop environment for the X Window System. The kdebase packages include core applications for KDE.

A privilege escalation flaw was found in the KDE Display Manager (KDM). A local user with console access could trigger a race condition, possibly resulting in the permissions of an arbitrary file being set to world-writable, allowing privilege escalation.
(CVE-2010-0436)

Red Hat would like to thank Sebastian Krahmer of the SuSE Security Team for responsibly reporting this issue.

Users of KDE should upgrade to these updated packages, which contain a backported patch to correct this issue. The system should be rebooted for this update to take effect. After the reboot, administrators should manually remove all leftover user-owned dmctl-* directories in '/var/run/xdmctl/'.

Sebastian Krahmer discovered a race condition in the KDE Display Manager (KDM). A local attacker could exploit this to change the permissions on arbitrary files, thus allowing privilege escalation.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Sebastian Krahmer discovered that a race condition in the KDE Desktop Environment's KDM display manager, allow a local user to elevate privileges to root.

A vulnerability has been found and corrected in kdm (kdebase/kdebase4-workspace) :

KDM contains a race condition that allows local attackers to make arbitrary files on the system world-writeable. This can happen while KDM tries to create its control socket during user login. This vulnerability has been discovered by Sebastian Krahmer from the SUSE Security Team (CVE-2010-0436).

It is adviced to reboot the computer after applying the updated packages in order to the security fix to take full effect.

Packages for 2008.0 are provided for Corporate Desktop 2008.0 customers.

The updated packages have been patched to correct this issue.

The KDE KDM contains a local race condition which allows to make arbitrary files world-writable. CVE-2010-0436 has been assigned to this issue.

KDE Security Advisory reports :

KDM contains a race condition that allows local attackers to make arbitrary files on the system world-writeable. This can happen while KDM tries to create its control socket during user login. A local attacker with a valid local account can under certain circumstances make use of this vulnerability to execute arbitrary code as root.

ID	Name	Product	Family	Severity
79961	GLSA-201412-08 : Multiple packages, Multiple vulnerabilities fixed in 2010	Nessus	Gentoo Local Security Checks	critical
68031	Oracle Linux 5 : kdebase (ELSA-2010-0348)	Nessus	Oracle Linux Local Security Checks	high
60781	Scientific Linux Security Update : kdebase on SL4.x, SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	medium
54878	Slackware 13.0 / current : kdebase-workspace (SSA:2010-110-02)	Nessus	Slackware Local Security Checks	medium
50921	SuSE 11 Security Update : kdm (SAT Patch Number 2136)	Nessus	SuSE Local Security Checks	medium
49851	SuSE 10 Security Update : kdm (ZYPP Patch Number 6941)	Nessus	SuSE Local Security Checks	medium
47499	Fedora 11 : kde-l10n-4.4.3-1.fc11 / kdeaccessibility-4.4.3-1.fc11.1 / kdeadmin-4.4.3-1.fc11.1 / etc (2010-8547)	Nessus	Fedora Local Security Checks	medium
47498	Fedora 12 : kde-l10n-4.4.3-1.fc12 / kdeaccessibility-4.4.3-1.fc12.1 / kdeadmin-4.4.3-1.fc12.1 / etc (2010-8544)	Nessus	Fedora Local Security Checks	medium
47440	Fedora 13 : kdebase-workspace-4.4.2-5.fc13 (2010-6605)	Nessus	Fedora Local Security Checks	medium
47415	Fedora 12 : PyQt4-4.7.2-2.fc12 / kdeaccessibility-4.4.2-1.fc12 / kdeadmin-4.4.2-1.fc12 / etc (2010-6096)	Nessus	Fedora Local Security Checks	medium
47414	Fedora 11 : PyQt4-4.7.2-2.fc11 / kdeaccessibility-4.4.2-1.fc11 / kdeadmin-4.4.2-1.fc11 / etc (2010-6077)	Nessus	Fedora Local Security Checks	medium
46298	RHEL 4 / 5 : kdebase (RHSA-2010:0348)	Nessus	Red Hat Local Security Checks	medium
45582	CentOS 4 / 5 : kdebase (CESA-2010:0348)	Nessus	CentOS Local Security Checks	medium
45576	Ubuntu 8.10 / 9.04 / 9.10 : kdebase-workspace vulnerability (USN-932-1)	Nessus	Ubuntu Local Security Checks	medium
45559	Debian DSA-2037-1 : kdm (kdebase) - race condition	Nessus	Debian Local Security Checks	medium
45548	Mandriva Linux Security Advisory : kdebase (MDVSA-2010:074)	Nessus	Mandriva Local Security Checks	medium
45539	SuSE 10 Security Update : kdm (ZYPP Patch Number 6942)	Nessus	SuSE Local Security Checks	medium
45538	openSUSE Security Update : kde4-kdm (openSUSE-SU-2010:0112-1)	Nessus	SuSE Local Security Checks	medium
45536	openSUSE Security Update : kde4-kdm (kde4-kdm-2134)	Nessus	SuSE Local Security Checks	medium
45534	openSUSE Security Update : fileshareset (fileshareset-2204)	Nessus	SuSE Local Security Checks	medium
45533	openSUSE Security Update : kde4-kdm (kde4-kdm-2134)	Nessus	SuSE Local Security Checks	medium
45531	openSUSE Security Update : fileshareset (fileshareset-2204)	Nessus	SuSE Local Security Checks	medium
45529	FreeBSD : KDM -- local privilege escalation vulnerability (3987c5d1-47a9-11df-a0d5-0016d32f24fb)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2010-0436

high

Tenable Plugins

critical

high

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium