April 2005

ID: 00347
Ref: 321/2005
Date: 22 April 2005:15:18:14
Version: 1

---

Title: Two KDE Security Advisories: 1. kimgio input validation errors 2. Kommander untrusted code execution
Abstract:
Vendors affected: KDE
Operating systems affected: KDE
Applications affected: KDE

---

Title
=====

Two KDE Security Advisories:

1. kimgio input validation errors

2. Kommander untrusted code execution

Detail
======

1. kimgio contains a PCX image file format reader that does
not properly perform input validation. A source code audit
performed by the KDE security team discovered several
vulnerabilities in the PCX and other image file format
readers, some of them exploitable to execute arbitrary
code.

2. Kommander is a visual editor and interpreter to edit and
interpret visual dialogs and execute scripts attached to
dialog actions. Kommander executes without user confirmation data files
from possibly untrusted locations. As they contain scripts, the
user might accidentally run arbitrary code.




1.




KDE Security Advisory: kimgio input validation errors
Original Release Date: 2005-04-21
URL: http://www.kde.org/info/security/advisory-20050421-1.txt

0. References

http://bugs.kde.org/102328
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-1046


1. Systems affected:

kdelibs as shipped with KDE 3.2 up to including KDE 3.4.


2. Overview:

kimgio contains a PCX image file format reader that does
not properly perform input validation. A source code audit
performed by the KDE security team discovered several
vulnerabilities in the PCX and other image file format
readers, some of them exploitable to execute arbitrary
code.


3. Impact:

Remotly supplied, specially crafted image files can be used
to execute arbitrary code.


4. Solution:

Source code patches have been made available which fix these
vulnerabilities. Contact your OS vendor / binary package provider
for information about how to obtain updated binary packages.


5. Patch:

A patch for KDE 3.4.0 is available from
ftp://ftp.kde.org/pub/kde/security_patches :

78473d4dad612e6617eb6652eec2ab80 post-3.4.0-kdelibs-kimgio.diff

A patch for KDE 3.3.2 is available from
ftp://ftp.kde.org/pub/kde/security_patches :

8366d0e5c8101c315a0bdafac54536d6 post-3.3.2-kdelibs-kimgio.diff


6. Time line and credits:

24/03/2005 Notification of KDE by Bruno Rohee
21/04/2005 Coordinated Public Disclosure




2.


KDE Security Advisory: Kommander untrusted code execution
Original Release Date: 2005-04-20
URL: http://www.kde.org/info/security/advisory-20050420-1.txt

0. References

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0754

1. Systems affected:

Quanta 3.1.x, KDE 3.2 and new up to including KDE 3.4.0.


2. Overview:

Kommander is a visual editor and interpreter to edit and
interpret visual dialogs and execute scripts attached to
dialog actions.

Kommander executes without user confirmation data files
from possibly untrusted locations. As they contain
scripts, the user might accidentally run arbitrary code.


3. Impact:

Remotly supplied kommander files from untrusted sources
are executed without confirmation.


4. Solution:

Source code patches have been made available which fix these
vulnerabilities. Contact your OS vendor / binary package provider
for information about how to obtain updated binary packages.


5. Patch:

A patch for KDE 3.4.0 is available from
ftp://ftp.kde.org/pub/kde/security_patches :

c388b21d91c8326fc9757cd8786713db post-3.4.0-kdewebdev-kommander.diff

A patch for KDE 3.3.2 is available from
ftp://ftp.kde.org/pub/kde/security_patches :

d210c07121c1ba3a97660a6e166738e6 post-3.3.2-kdewebdev-kommander.diff


6. Time line and credits:

13/03/2005 Notification of KDE security by Eckhart Wörner
20/04/2005 Public Disclosure


_______________________________________________
kde-announce mailing list
kde-announce@kde.org
https://mail.kde.org/mailman/listinfo/kde-announce