Directory traversal vulnerability in KArchive before 5.24, as used in KDE Frameworks, allows remote attackers to write to arbitrary files via a ../ (dot dot slash) in a filename in an archive file, related to KNewsstuff downloads.

The remote Ubuntu 16.04 LTS / 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4100-1 advisory.

    It was discovered that KConfig and KDE libraries have a vulnerability where an attacker could hide     malicious code under desktop and configuration files. (CVE-2019-14744)

    It was discovered that KConfig allows remote attackers to write to arbitrary files via a ../ in a filename     in an archive file. (CVE-2016-6232)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This kdelibs3 (KDE 3 compatibility libraries) update fixes the security issues :

  - CVE-2016-6232 (karchive): Extraction of tar files     possible to arbitrary system locations

  - CVE-2017-6410 (kio): Information Leak when accessing     https when using a malicious PAC file

for the KDE 3 compatibility libraries. (Security updates for KDE Frameworks 5 (kf5-karchive resp. kf5-kio) and for the KDE 4 compatibility libraries (kdelibs 4) have already been submitted.)

In addition, the KDE 3 compatibility version of KCrash was modified to use the DrKonqi from Plasma 5 rather than from kde-runtime 4. (The original KDE 3 DrKonqi was already dropped years ago.) The kde-runtime 4 DrKonqi is not installed by default and will be removed entirely in future Fedora versions, the Plasma 5 version of DrKonqi can also be used for legacy applications.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

David Faure reports :

A maliciously crafted archive (.zip or .tar.bz2) with '../' in the file paths could be offered for download via the KNewStuff framework (e.g. on www.kde-look.org), and upon extraction would install files anywhere in the user's home directory.

Andreas Cord-Landwehr discovered that kde4libs, the core libraries for all KDE 4 applications, do not properly handle the extraction of archives with '../' in the file paths. A remote attacker can take advantage of this flaw to overwrite files outside of the extraction folder, if a user is tricked into extracting a specially crafted archive.

It was possible to trick kde4libs's KArchiveDirectory::copyTo() function to extract files to arbitrary system locations from a specially prepared tar file outside of the extraction folder.

For Debian 7 'Wheezy', these problems have been fixed in version 4:4.8.4-4+deb7u2.

We recommend that you upgrade your kde4libs packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for karchive fixes the following issues :

  - CVE-2016-6232: A remote attacker could have been able to     overwrite arbitrary files when tricking the user into     downloading KDE extras such as wallpapers or Plasma     Applets (boo#989698)

The remote Ubuntu 14.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-3042-1 advisory.

    Andreas Cord-Landwehr discovered that KDE-Libs incorrectly handled extracting certain archives. If a user     were tricked into extracting a specially-crafted archive, a remote attacker could use this issue to     overwrite arbitrary files out of the extraction directory.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

KDE Frameworks 5.24, see also https://www.kde.org/announcements/kde-frameworks-5.24.0.php

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

KDE Frameworks 5.24, see also see also https://www.kde.org/announcements/kde-frameworks-5.24.0.php

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
128025	Ubuntu 16.04 LTS / 18.04 LTS : KConfig and KDE libraries vulnerabilities (USN-4100-1)	Nessus	Ubuntu Local Security Checks	high
97678	Fedora 25 : kdelibs3 (2017-4f4eef4791)	Nessus	Fedora Local Security Checks	high
97672	Fedora 24 : kdelibs3 (2017-01eed6fe8c)	Nessus	Fedora Local Security Checks	high
93144	FreeBSD : kdelibs -- directory traversal vulnerability (4472ab39-6c66-11e6-9ca5-50e549ebab6c)	Nessus	FreeBSD Local Security Checks	high
92764	Debian DSA-3643-1 : kde4libs - security update	Nessus	Debian Local Security Checks	high
92634	Debian DLA-570-1 : kde4libs security update	Nessus	Debian Local Security Checks	high
92594	openSUSE Security Update : karchive (openSUSE-2016-904)	Nessus	SuSE Local Security Checks	high
92583	Ubuntu 14.04 LTS : KDE-Libs vulnerability (USN-3042-1)	Nessus	Ubuntu Local Security Checks	high
92549	Fedora 23 : 1:oxygen-icon-theme / breeze-icon-theme / extra-cmake-modules / kf5 / etc (2016-cef912e3a4)	Nessus	Fedora Local Security Checks	high
92530	Fedora 24 : 1:oxygen-icon-theme / breeze-icon-theme / extra-cmake-modules / kf5 / etc (2016-4701636a74)	Nessus	Fedora Local Security Checks	high

Detections

Analytics

CVE-2016-6232

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high