[UNIX] Kommander Untrusted Code Execution

From: SecuriTeam (support_at_securiteam.com)
Date: 04/25/05

  • Next message: SecuriTeam: "[UNIX] Canonicalization and Directory Traversal in iSeries FTP Security Products" 
    To: list@securiteam.com
Date: 25 Apr 2005 16:06:09 +0200

    The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
    - - promotion

    The SecuriTeam alerts list - Free, Accurate, Independent.

    Get your security news from a reliable source.
    http://www.securiteam.com/mailinglist.html

    - - - - - - - - -

      Kommander Untrusted Code Execution
    ------------------------------------------------------------------------

    SUMMARY

    Kommander is "a visual editor and interpreter to edit and interpret visual
    dialogs and execute scripts attached to dialog actions".

    Kommander executes without user confirmation data files from possibly
    untrusted locations. As they contain scripts, the user might accidentally
    run arbitrary code.

    DETAILS

    Systems affected:
     * Quanta 3.1.x, KDE 3.2 and new up to including KDE 3.4.0

    Impact:
    Remotly supplied kommander files from untrusted sources are executed
    without confirmation.

    Solution:
    Source code patches have been made available which fix these
    vulnerabilities. Contact your OS vendor / binary package provider for
    information about how to obtain updated binary packages.

    Patch:
    A patch for KDE 3.4.0 is available from
    <ftp://ftp.kde.org/pub/kde/security_patches>
    ftp://ftp.kde.org/pub/kde/security_patches :

    c388b21d91c8326fc9757cd8786713db post-3.4.0-kdewebdev-kommander.diff

    A patch for KDE 3.3.2 is available from
    <ftp://ftp.kde.org/pub/kde/security_patches>
    ftp://ftp.kde.org/pub/kde/security_patches :

    d210c07121c1ba3a97660a6e166738e6 post-3.3.2-kdewebdev-kommander.diff

    Time line and credits:
    13/03/2005 Notification of KDE security by Eckhart W rner
    20/04/2005 Public Disclosure

    CVE Information:
     <http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0754>
    CAN-2005-0754

    ADDITIONAL INFORMATION

    The information has been provided by <mailto:dirk@kde.org> Dirk Mueller.
    The original article can be found at:
    <http://www.kde.org/info/security/advisory-20050420-1.txt>
    http://www.kde.org/info/security/advisory-20050420-1.txt

    ========================================

    This bulletin is sent to members of the SecuriTeam mailing list.
    To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
    In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

    ====================
    ====================

    DISCLAIMER:
    The information in this bulletin is provided "AS IS" without warranty of any kind.
    In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

  • Next message: SecuriTeam: "[UNIX] Canonicalization and Directory Traversal in iSeries FTP Security Products"

    Relevant Pages

    • [NT] Multiple Vendor Insecure use of CreateProcess()
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Improper use of Windows API command CreateProcess allows attackers to ... until a module is encountered to execute. ... This creates a scenario whereby arbitrary code could be executed. ...
      (Securiteam)
    • [UNIX] kpdf Buffer Overflow Vulnerability
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... kpdf, the KDE pdf viewer, shares code with xpdf. ... Patch for KDE 3.2.3 is available from ...
      (Securiteam)
    • [UNIX] Kpdf/Koffice Multiple Buffer Overflows (Xpdf)
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... kpdf, the KDE pdf viewer, shares code with xpdf. ... integer overflow vulnerabilities that allow specially crafted PDF files, ... Patch for KDE 3.5.0 is available from ...
      (Securiteam)
    • [NT] Switch Off Multiple Vulnerabilities
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Stack-based Buffer Overflow: ... execute arbitrary code on the remote system - possibly with SYSTEM ... boundaries until the ecx register reaches zero (where the ecx was the ...
      (Securiteam)
    • [NEWS] URL Parsing and Plain Text Password disclosure in Best Buy Employee Toolkit Software
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... entered in the URL area and an attacker could use this to execute a local ... command shell or execute other programs locally stored. ... Store's central server. ...
      (Securiteam)