CVE-2006-2449 - KDE Display Manager (KDM) in KDE 3.2.0 up to 3.5.3 allows local users to read arbitrary files via a

CVE-2006-2449

Summary

KDE Display Manager (KDM) in KDE 3.2.0 up to 3.5.3 allows local users to read arbitrary files via a symlink attack related to the session type for login. Vendor links provide patches for each version affected.

References

Vulnerable Configurations

cpe:2.3:o:kde:kde:3.2:*:*:*:*:*:*:*
cpe:2.3:o:kde:kde:3.2:*:*:*:*:*:*:*
cpe:2.3:o:kde:kde:3.2.1:*:*:*:*:*:*:*
cpe:2.3:o:kde:kde:3.2.1:*:*:*:*:*:*:*
cpe:2.3:o:kde:kde:3.2.2:*:*:*:*:*:*:*
cpe:2.3:o:kde:kde:3.2.2:*:*:*:*:*:*:*
cpe:2.3:o:kde:kde:3.2.3:*:*:*:*:*:*:*
cpe:2.3:o:kde:kde:3.2.3:*:*:*:*:*:*:*
cpe:2.3:o:kde:kde:3.3:*:*:*:*:*:*:*
cpe:2.3:o:kde:kde:3.3:*:*:*:*:*:*:*
cpe:2.3:o:kde:kde:3.3.1:*:*:*:*:*:*:*
cpe:2.3:o:kde:kde:3.3.1:*:*:*:*:*:*:*
cpe:2.3:o:kde:kde:3.3.2:*:*:*:*:*:*:*
cpe:2.3:o:kde:kde:3.3.2:*:*:*:*:*:*:*
cpe:2.3:o:kde:kde:3.4:*:*:*:*:*:*:*
cpe:2.3:o:kde:kde:3.4:*:*:*:*:*:*:*
cpe:2.3:o:kde:kde:3.4.1:*:*:*:*:*:*:*
cpe:2.3:o:kde:kde:3.4.1:*:*:*:*:*:*:*
cpe:2.3:o:kde:kde:3.4.2:*:*:*:*:*:*:*
cpe:2.3:o:kde:kde:3.4.2:*:*:*:*:*:*:*
cpe:2.3:o:kde:kde:3.4.3:*:*:*:*:*:*:*
cpe:2.3:o:kde:kde:3.4.3:*:*:*:*:*:*:*
cpe:2.3:o:kde:kde:3.5:*:*:*:*:*:*:*
cpe:2.3:o:kde:kde:3.5:*:*:*:*:*:*:*
cpe:2.3:o:kde:kde:3.5.2:*:*:*:*:*:*:*
cpe:2.3:o:kde:kde:3.5.2:*:*:*:*:*:*:*
cpe:2.3:o:kde:kde:3.5.3:*:*:*:*:*:*:*
cpe:2.3:o:kde:kde:3.5.3:*:*:*:*:*:*:*

CVSS

Base:	4.0 (as of 18-10-2018 - 16:40)
Impact:
Exploitability:

CWE

NVD-CWE-Other

CAPEC

Access

Vector	Complexity	Authentication
LOCAL	HIGH	NONE

Impact

Confidentiality	Integrity	Availability
COMPLETE	NONE	NONE

cvss-vector via4

AV:L/AC:H/Au:N/C:C/I:N/A:N

oval via4

accepted

2013-04-29T04:22:43.477-04:00

class

vulnerability

contributors

name Aharon Chernin
organization SCAP.com, LLC
name Dragos Prisaca
organization G2, Inc.

definition_extensions

comment The operating system installed on the system is Red Hat Enterprise Linux 4
oval oval:org.mitre.oval:def:11831
comment CentOS Linux 4.x
oval oval:org.mitre.oval:def:16636
comment Oracle Linux 4.x
oval oval:org.mitre.oval:def:15990

description

KDE Display Manager (KDM) in KDE 3.2.0 up to 3.5.3 allows local users to read arbitrary files via a symlink attack related to the session type for login.

family

unix

oval:org.mitre.oval:def:9844

status

accepted

submitted

2010-07-09T03:56:16-04:00

title

KDE Display Manager (KDM) in KDE 3.2.0 up to 3.5.3 allows local users to read arbitrary files via a symlink attack related to the session type for login.

version

redhat via4

advisories

bugzilla

id	1618107
title	CVE-2006-2449 security flaw

oval

comment Red Hat Enterprise Linux must be installed
oval oval:com.redhat.rhba:tst:20070304026

AND

comment Red Hat Enterprise Linux 4 is installed
oval oval:com.redhat.rhba:tst:20070304025

AND
comment kdebase is earlier than 6:3.3.1-5.12
oval oval:com.redhat.rhsa:tst:20060548001
comment kdebase is signed with Red Hat master key
oval oval:com.redhat.rhsa:tst:20060548002
AND
comment kdebase-devel is earlier than 6:3.3.1-5.12
oval oval:com.redhat.rhsa:tst:20060548003
comment kdebase-devel is signed with Red Hat master key
oval oval:com.redhat.rhsa:tst:20060548004

rhsa

id	RHSA-2006:0548
released	2006-06-14
severity	Important
title	RHSA-2006:0548: kdebase security update (Important)

rpms

kdebase-6:3.3.1-5.12
kdebase-debuginfo-6:3.3.1-5.12
kdebase-devel-6:3.3.1-5.12

refmap via4

bid	18431
bugtraq	20060614 [KDE Security Advisory] KDM symlink attack vulnerability 20060615 rPSA-2006-0106-1 kdebase
confirm	http://www.kde.org/info/security/advisory-20060614-1.txt
debian	DSA-1156
gentoo	GLSA-200606-23
mandriva	MDKSA-2006:105 MDKSA-2006:106
osvdb	26511
sectrack	1016297
secunia	20602 20660 20674 20702 20785 20869 20890 21662
slackware	SSA:2006-178-01
suse	SUSE-SA:2006:039
ubuntu	USN-301-1
vupen	ADV-2006-2355
xf	kde-kdm-symlink(27181)

Last major update

18-10-2018 - 16:40

Published

15-06-2006 - 10:02

Last modified

18-10-2018 - 16:40