Directory traversal vulnerability in the KGetMetalink::File::isValidNameAttr function in ui/metalinkcreator/metalinker.cpp in KGet in KDE SC 4.6.2 and earlier allows remote attackers to create arbitrary files via a .. (dot dot) in the name attribute of a file element in a metalink file. NOTE: this vulnerability exists because of an incomplete fix for CVE-2010-1000.

From Red Hat Security Advisory 2011:0465 :

Updated kdenetwork packages that fix one security issue are now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

The kdenetwork packages contain networking applications for the K Desktop Environment (KDE).

A directory traversal flaw was found in the way KGet, a download manager, handled the 'file' element in Metalink files. An attacker could use this flaw to create a specially crafted Metalink file that, when opened, would cause KGet to overwrite arbitrary files accessible to the user running KGet. (CVE-2011-1586)

Users of kdenetwork should upgrade to these updated packages, which contain a backported patch to resolve this issue. The desktop must be restarted (log out, then log back in) for this update to take effect.

A directory traversal flaw was found in the way KGet, a download manager, handled the 'file' element in Metalink files. An attacker could use this flaw to create a specially crafted Metalink file that, when opened, would cause KGet to overwrite arbitrary files accessible to the user running KGet. (CVE-2011-1586)

The desktop must be restarted (log out, then log back in) for this update to take effect.

It was discovered that KGet did not properly perform input validation when processing metalink files. If a user were tricked into opening a crafted metalink file, a remote attacker could overwrite files via directory traversal, which could eventually lead to arbitrary code execution.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A vulnerability has been found and corrected in kdenetwork4 :

Directory traversal vulnerability in the KGetMetalink::File::isValidNameAttr function in ui/metalinkcreator/metalinker.cpp in KGet in KDE SC 4.6.2 and earlier allows remote attackers to create arbitrary files via a .. (dot dot) in the name attribute of a file element in a metalink file. NOTE: this vulnerability exists because of an incomplete fix for CVE-2010-1000 (CVE-2011-1586).

Packages for 2009.0 are provided as of the Extended Maintenance Program. Please visit this link to learn more:
http://store.mandriva.com/product_info.php?cPath=149 products_id=490

The updated packages have been patched to correct this issue.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2011:0465 advisory.

  - kdenetwork: incomplete fix for CVE-2010-1000 (CVE-2011-1586)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
68260	Oracle Linux 6 : kdenetwork (ELSA-2011-0465)	Nessus	Oracle Linux Local Security Checks	medium
61024	Scientific Linux Security Update : kdenetwork on SL6.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	medium
55072	Ubuntu 9.10 / 10.04 LTS / 10.10 : kdenetwork vulnerability (USN-1114-1)	Nessus	Ubuntu Local Security Checks	medium
53628	Mandriva Linux Security Advisory : kdenetwork4 (MDVSA-2011:081)	Nessus	Mandriva Local Security Checks	medium
53526	RHEL 6 : kdenetwork (RHSA-2011:0465)	Nessus	Red Hat Local Security Checks	critical

Detections

Analytics

CVE-2011-1586

critical

Tenable Plugins

medium

medium

medium

medium

critical