Matthias Hoelzer-Kluepfe
writes:
Lately, a problem in one of the KDE libs, libmediatool, was
reported. The problem allows local users to create or modify files
as the user running KDE.
A patch for the problem was made available by Christian Esken
(KDE core team) and Olaf Kirch (Caldera Systems).
Please apply the patch to your installations as soon as
possible. The advisory is attached.
————————————————————–
1. Problem Description
Local users may create files as the user running KDE.
One of KDE’s libraries, libmediatool, has a /tmp race problem.
The problem is the way the library creates /tmp files. You can
predict when a file will be created and create a symlink with the
same name.
2. Vulnerable Versions
kdelibs <= 1.1
3. Solutions
The proper solution is to apply the patch
ftp://ftp.kde.org/pub/kde/security_patches/kdelibs-1.1-connect.patch
4. Verification
The MD5 checksum (from the “md5sum” command) for the patch
is:
8742ccc0fc1d2bf94e426747b9da3894 kdelibs-1.1-connect.patch