Advisories, June 22, 2006

http://security.gentoo.org/

Severity: High
Title: aRts: Privilege escalation
Date: June 22, 2006
Bugs: #135970
ID: 200606-22

Synopsis

The artswrapper part of aRts allows local users to execute arbitrary code with elevated privileges.

Background

aRts is a real time modular system for synthesizing audio used by KDE. artswrapper is a helper application used to start the aRts daemon.

Affected packages

     Package        /  Vulnerable  /                        Unaffected

  1  kde-base/arts     < 3.5.2-r1                          >= 3.5.2-r1
                                                          *>= 3.4.3-r1

Description

artswrapper fails to properly check whether it can drop privileges accordingly if setuid() fails due to a user exceeding assigned resource limits.

Impact

Local attackers could exploit this vulnerability to execute arbitrary code with elevated privileges. Note that the aRts package provided by Gentoo is only vulnerable if the artswrappersuid USE-flag is enabled.

Workaround

There is no known workaround at this time.

Resolution

All aRts users should upgrade to the latest version:

    # emerge --sync
    # emerge --ask --oneshot --verbose kde-base/arts

References

[ 1 ] CVE-2006-2916

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2916

Availability

This GLSA and any updates to it are available for viewing at the Gentoo Security Website:

http://security.gentoo.org/glsa/glsa-200606-22.xml

Concerns?

Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at http://bugs.gentoo.org.

License

Copyright 2006 Gentoo Foundation, Inc; referenced text belongs to its owner(s).

The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license.

http://creativecommons.org/licenses/by-sa/2.5

http://security.gentoo.org/

Severity: Normal
Title: KDM: Symlink vulnerability
Date: June 22, 2006
Bugs: #136201
ID: 200606-23

Synopsis

KDM is vulnerable to a symlink vulnerability that can lead to disclosure of information.

Background

KDE is a feature-rich graphical desktop environment for Linux and Unix-like Operating Systems. KDM is the KDE Display Manager and is part of the kdebase package.

Affected packages

     Package           /  Vulnerable  /                     Unaffected

  1  kde-base/kdebase     < 3.5.2-r2                       >= 3.5.2-r2
                                                          *>= 3.4.3-r2
  2  kde-base/kdm         < 3.5.2-r2                       >= 3.5.2-r2
                                                          *>= 3.4.3-r2
    -------------------------------------------------------------------
     2 affected packages on all of their supported architectures.

Description

Ludwig Nussel discovered that KDM could be tricked into allowing users to read files that would otherwise not be readable.

Impact

A local attacker could exploit this issue to obtain potentially sensitive information that is usually not accessable to the local user such as shadow files or other user's files. The default Gentoo user running KDM is root and, as a result, the local attacker can read any file.

Workaround

There is no known workaround at this time.

Resolution

All kdebase users should upgrade to the latest version:

    # emerge --sync
    # emerge --ask --oneshot --verbose kde-base/kdebase

All KDE split ebuild users should upgrade to the latest KDM version:

    # emerge --sync
    # emerge --ask --oneshot --verbose kde-base/kdm

References

[ 1 ] KDE Security Advisory: KDM symlink attack vulnerability

http://www.kde.org/info/security/advisory-20060614-1.txt

[ 2 ] CVE-2006-2449

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2449

Availability

This GLSA and any updates to it are available for viewing at the Gentoo Security Website:

http://security.gentoo.org/glsa/glsa-200606-23.xml

Concerns?

Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at http://bugs.gentoo.org.

License

Copyright 2006 Gentoo Foundation, Inc; referenced text belongs to its owner(s).

The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license.

http://creativecommons.org/licenses/by-sa/2.5