Detections
Analytics

Debian DSA-155-1 : kdelibs - privacy escalation with Konqueror

high Nessus Plugin ID 14992

Synopsis

The remote Debian host is missing a security-related update.

Description

Due to a security engineering oversight, the SSL library from KDE, which Konqueror uses, doesn't check whether an intermediate certificate for a connection is signed by the certificate authority as safe for the purpose, but accepts it when it is signed. This makes it possible for anyone with a valid VeriSign SSL site certificate to forge any other VeriSign SSL site certificate, and abuse Konqueror users.

A local root exploit using artsd has been discovered which exploited an insecure use of a format string. The exploit wasn't working on a Debian system since artsd wasn't running setuid root. Neither artsd nor artswrapper need to be setuid root anymore since current computer systems are fast enough to handle the audio data in time.

These problems have been fixed in version 2.2.2-13.woody.2 for the current stable distribution (woody). The old stable distribution (potato) is not affected, since it doesn't contain KDE packages. The unstable distribution (sid) is not yet fixed, but new packages are expected in the future, the fixed version will be version 2.2.2-14 or higher.

Solution

Upgrade the kdelibs and libarts packages and restart Konqueror.

See Also

http://www.debian.org/security/2002/dsa-155

Plugin Details

Severity: High

ID: 14992

File Name: debian_DSA-155.nasl

Version: 1.21

Type: local

Agent: unix

Published: 9/29/2004

Updated: 1/4/2021

Supported Sensors: Agentless Assessment, Continuous Assessment, Frictionless Assessment Agent, Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 5.5

CVSS v2

Risk Factor: High

Base Score: 7.5

Temporal Score: 5.5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

Vulnerability Information

CPE: p-cpe:/a:debian:debian_linux:kdelibs, cpe:/o:debian:debian_linux:3.0

Required KB Items: Host/local_checks_enabled, Host/Debian/release, Host/Debian/dpkg-l

Exploit Ease: No known exploits are available

Patch Publication Date: 8/17/2002

Reference Information

CVE: CVE-2002-0970

BID: 5410

DSA: 155