Bug 55560 (CVE-2004-0411)

Date: Fri, 14 May 2004 00:19:56 +0200
From: Waldo Bastian <bastian@kde.org>
To: kde-packager@kde.org, vendor-sec@lst.de
Cc: security@kde.org, kde-maintainers@suse.de
Subject: [vendor-sec] [PRENOTIFICATION] KDE Security Advisory: Telnet URI
    Handler File Vulnerability
Parts/Attachments:
   1 Shown   ~94 lines  Text
   2   OK     26 lines  Text
   3   OK     29 lines  Text
   4   OK     29 lines  Text
----------------------------------------

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


The following security advisory will be released on Monday, May 17. Patches 
will be published on the ftp site on monday and have been attached to this 
e-mail.

Cheers,
Waldo
- -- 
bastian@kde.org  |   Novell BrainShare Europe 2004   |  bastian@suse.com
bastian@kde.org  | 12-18 September, Barcelona, Spain |  bastian@suse.com


KDE Security Advisory: Telnet URI Handler File Vulnerability
Original Release Date: 2004-05-17
URL: http://www.kde.org/info/security/advisory-20040517-1.txt

0. References

       http://www.idefense.com/application/poi/display?id=104
        http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0411


1. Systems affected:

        All versions of KDE up to KDE 3.2.2 inclusive. 


2. Overview:

        iDEFENSE identified a vulnerability in the Opera Web Browser
        that could allow remote attackers to create or truncate
        arbitrary files. The KDE team has found that a similar
        vulnerability exists in KDE.

        The problem specifically exists within the telnet URI handler.
        The telnet handler does not check for '-' at the beginning of
        the hostname passed through the handler, which lets options pass
        to the telnet program, allowing file creation or overwriting.

        The Common Vulnerabilities and Exposures project (cve.mitre.org)
        has assigned the name CAN-2004-0411 to this issue.


3. Impact:

        A remote attacker could entice a user to open a carefully crafted
        telnet URI which may either create or truncate a file in the
        victims home directory. In KDE 3.2 and later versions the user
        is first explicitly asked to confirm the opening of the telnet URI.


4. Solution:

        As a workaround, remove the telnet.protocol file.


5. Patch:

        A patch for KDE 3.0.5b is available from
        ftp://ftp.kde.org/pub/kde/security_patches : 

  eaf9237b3af56b3b01df966b13fe2714  post-3.0.5b-kdelibs-ktelnetservice.patch

        A patch for KDE 3.1.5 is available from
        ftp://ftp.kde.org/pub/kde/security_patches : 

  bde52aa0bba055c4f678540ec20bfe5a  post-3.1.5-kdelibs-ktelnetservice.patch

        A patch for KDE 3.2.2 is available from
        ftp://ftp.kde.org/pub/kde/security_patches : 


  52e0e955204a77781505d33b9a3c341d  post-3.2.2-kdelibs-ktelnetservice.patch


6. Time line and credits:

        02/04/2003 Exploit acquired by iDEFENSE
       12/05/2004 Public disclosure of Opera vulnerability
        13/05/2004 KDE Team informed by Martin Ostertag
       13/05/2004 Patches created
       14/05/2004 Vendors notified
        17/05/2004 Public advisory

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.2 (GNU/Linux)

iD8DBQFAo/SMN4pvrENfboIRAuD0AJ9rMXS9Xu/xNXNEdGFuHTNPy4V0egCfUyM4
UrmeDwq5YcWmGJk9s9eH86k=
=sKz0