! NOT PUBLIC! KEEP INSIDE SUSE. 
  
KDE Security Advisory: Kommander untrusted code execution 
Original Release Date: 2005-04-20 
URL: http://www.kde.org/info/security/advisory-20050420-1.txt 
 
0. References 
 
        ? 
 
1. Systems affected: 
 
        Quanta 3.1.x, KDE 3.2 and new up to including KDE 3.4.0. 
 
 
2. Overview: 
 
        Kommander is a visual editor and interpreter to edit and 
        interpret visual dialogs and execute scripts attached to 
        dialog actions. 
 
        Kommander executes without user confirmation data files 
        from possibly untrusted locations. As they contain 
        scripts, the user might accidentally run arbitrary code. 
 
 
3. Impact: 
 
        Remotly supplied kommander files from untrusted sources 
        are executed without confirmation. 
 
 
4. Solution: 
 
        Source code patches have been made available which fix these 
        vulnerabilities. Contact your OS vendor / binary package provider 
        for information about how to obtain updated binary packages. 
 
 
5. Patch: 
 
        A patch for KDE 3.4 is available from 
 
        ftp://ftp.kde.org/pub/kde/security_patches : 
 
        XXXXX 
 
 
6. Time line and credits: 
 
        13/03/2005 Notification of KDE security by Eckhart W??rner 
        20/04/2005 Coordinated Public Disclosure