The KDE KDM contains a local race condition which allows to make arbitrary files world-writable. CVE-2010-0436 has been assigned to this issue.

Updated kdebase packages that fix one security issue are now available for Red Hat Enterprise Linux 4 and 5.

The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

The K Desktop Environment (KDE) is a graphical desktop environment for the X Window System. The kdebase packages include core applications for KDE.

A privilege escalation flaw was found in the KDE Display Manager (KDM). A local user with console access could trigger a race condition, possibly resulting in the permissions of an arbitrary file being set to world-writable, allowing privilege escalation.
(CVE-2010-0436)

Red Hat would like to thank Sebastian Krahmer of the SuSE Security Team for responsibly reporting this issue.

Users of KDE should upgrade to these updated packages, which contain a backported patch to correct this issue. The system should be rebooted for this update to take effect. After the reboot, administrators should manually remove all leftover user-owned dmctl-* directories in '/var/run/xdmctl/'.

The KDE display manager kdm contains a race condition which allows local attackers to make arbitrary files orld writable. CVE-2010-0436 has been assigned to this issue.

This build includes * a couple of small powerdevil patches (see kde bugs 221637, 221637), * fix icon name in plasma-konsole patch: use XDG icon instead of kappfinder one, * initial attempts at kdm/plymouth integration, * upstream kdm security fix for CVE-2010-0436

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201412-08 (Multiple packages, Multiple vulnerabilities fixed in 2010)

    Vulnerabilities have been discovered in the packages listed below.
      Please review the CVE identifiers in the Reference section for details.
      Insight       Perl Tk Module       Source-Navigator       Tk       Partimage       Mlmmj       acl       Xinit       gzip       ncompress       liblzw       splashutils       GNU M4       KDE Display Manager       GTK+       KGet       dvipng       Beanstalk       Policy Mount       pam_krb5       GNU gv       LFTP       Uzbl       Slim       Bitdefender Console       iputils       DVBStreamer   Impact :

    A context-dependent attacker may be able to gain escalated privileges,       execute arbitrary code, cause Denial of Service, obtain sensitive       information, or otherwise bypass security restrictions.
  Workaround :

    There are no known workarounds at this time.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
45531	openSUSE Security Update : fileshareset (fileshareset-2204)	Nessus	SuSE Local Security Checks	2010/4/15	2021/1/14	medium
45582	CentOS 4 / 5 : kdebase (CESA-2010:0348)	Nessus	CentOS Local Security Checks	2010/4/21	2021/1/4	medium
46298	RHEL 4 / 5 : kdebase (RHSA-2010:0348)	Nessus	Red Hat Local Security Checks	2010/5/11	2021/1/14	medium
45533	openSUSE Security Update : kde4-kdm (kde4-kdm-2134)	Nessus	SuSE Local Security Checks	2010/4/15	2021/1/14	medium
45539	SuSE 10 Security Update : kdm (ZYPP Patch Number 6942)	Nessus	SuSE Local Security Checks	2010/4/15	2021/1/14	medium
47440	Fedora 13 : kdebase-workspace-4.4.2-5.fc13 (2010-6605)	Nessus	Fedora Local Security Checks	2010/7/1	2021/1/11	medium
79961	GLSA-201412-08 : Multiple packages, Multiple vulnerabilities fixed in 2010	Nessus	Gentoo Local Security Checks	2014/12/15	2021/1/6	critical
45538	openSUSE Security Update : kde4-kdm (openSUSE-SU-2010:0112-1)	Nessus	SuSE Local Security Checks	2010/4/15	2021/1/14	medium

检测

插件搜索

medium

medium

medium

medium

medium

medium

critical

medium