OSVDB ID: 8589

Title: KDE DCOPServer Insecure Temporary File Manipulation

Info

Disclosure
Aug 11, 2004

Discovery
Unknown

Dates

Exploit
Aug 11, 2004

Solution
Unknown

Description

 KDE DCOPServer contains a flaw that may allow a malicious user to compromise local user accounts. The issue is triggered when DCOPserver creates insecure temporary files which may be used for authentication purposes occurs. It is possible that the flaw may allow a local attacker to compromise local accounts that run applications within KDE resulting in a loss of confidentiality, and integrity.

Classification

 Location: Local Access Required
Attack Type: Misconfiguration
Impact: Loss of Confidentiality, Loss of Integrity
Exploit: Exploit Public
Disclosure: OSVDB Verified

Solution

 Currently, there are no known workarounds or upgrades to correct this issue. However, KDE has released a patch to address this vulnerability.

Products

KDE Project

KDE

 3.2.3
3.2.2
3.2.1
3.2.0
3.1.x
2.x
1.x
3.0.x

References

Credit
  • Colin Phipps - cphcph.demon.co.uk -
  • Chris Cheney -


Direct URL: http://osvdb.org/8589