ID CVE-2008-1671
Summary start_kdeinit in KDE 3.5.5 through 3.5.9, when installed setuid root, allows local users to cause a denial of service and possibly execute arbitrary code via "user-influenceable input" (probably command-line arguments) that cause start_kdeinit to send SIGUSR1 signals to other processes.
References
Vulnerable Configurations
  • cpe:2.3:o:kde:kde:3.5.5
    cpe:2.3:o:kde:kde:3.5.5
  • cpe:2.3:o:kde:kde:3.5.6
    cpe:2.3:o:kde:kde:3.5.6
  • cpe:2.3:o:kde:kde:3.5.7
    cpe:2.3:o:kde:kde:3.5.7
  • cpe:2.3:o:kde:kde:3.5.8
    cpe:2.3:o:kde:kde:3.5.8
  • cpe:2.3:o:kde:kde:3.5.9
    cpe:2.3:o:kde:kde:3.5.9
CVSS
Base: 4.6 (as of 28-04-2008 - 13:34)
Impact:
Exploitability:
CWE CWE-16
CAPEC
Access
VectorComplexityAuthentication
LOCAL LOW NONE
Impact
ConfidentialityIntegrityAvailability
PARTIAL PARTIAL PARTIAL
nessus via4
  • NASL family Mandriva Local Security Checks
    NASL id MANDRIVA_MDVSA-2008-097.NASL
    description A vulnerability was found in start_kdeinit in KDE 3.5.5 through 3.5.9 where, if it was installed setuid root, it could allow local users to cause a denial of service or possibly execute arbitrary code (CVE-2008-1671). By default, start_kdeinit is not installed setuid root on Mandriva Linux, however updated packages have been patched to correct this issue.
    last seen 2019-02-21
    modified 2018-07-19
    plugin id 36729
    published 2009-04-23
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=36729
    title Mandriva Linux Security Advisory : kdelibs (MDVSA-2008:097)
  • NASL family SuSE Local Security Checks
    NASL id SUSE_KDELIBS3-5223.NASL
    description Start_kdeinit did not handle unix signals the right way (CVE-2008-1671)
    last seen 2019-02-21
    modified 2014-06-13
    plugin id 32179
    published 2008-05-09
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=32179
    title openSUSE 10 Security Update : kdelibs3 (kdelibs3-5223)
  • NASL family Slackware Local Security Checks
    NASL id SLACKWARE_SSA_2008-116-01.NASL
    description New kdelibs packages are available for Slackware 12.0 and -current to fix a security issue.
    last seen 2019-02-21
    modified 2018-11-19
    plugin id 32056
    published 2008-04-28
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=32056
    title Slackware 12.0 / current : kdelibs (SSA:2008-116-01)
  • NASL family Ubuntu Local Security Checks
    NASL id UBUNTU_USN-608-1.NASL
    description It was discovered that start_kdeinit in KDE 3 did not properly sanitize its input. A local attacker could exploit this to send signals to other processes and cause a denial of service or possibly execute arbitrary code. (CVE-2008-1671). Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-11-28
    plugin id 32188
    published 2008-05-09
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=32188
    title Ubuntu 7.04 / 7.10 / 8.04 LTS : kdelibs vulnerability (USN-608-1)
  • NASL family Gentoo Local Security Checks
    NASL id GENTOO_GLSA-200804-30.NASL
    description The remote host is affected by the vulnerability described in GLSA-200804-30 (KDE start_kdeinit: Multiple vulnerabilities) Vulnerabilities have been reported in the processing of user-controlled data by start_kdeinit, which is setuid root by default. Impact : A local attacker could possibly execute arbitrary code with root privileges, cause a Denial of Service or send Unix signals to other processes, when start_kdeinit is setuid root. Workaround : There is no known workaround at this time.
    last seen 2019-02-21
    modified 2015-04-13
    plugin id 32111
    published 2008-05-01
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=32111
    title GLSA-200804-30 : KDE start_kdeinit: Multiple vulnerabilities
refmap via4
bid 28938
confirm
gentoo GLSA-200804-30
mandriva MDVSA-2008:097
sectrack 1019924
secunia
  • 29951
  • 29977
  • 30113
suse SUSE-SR:2008:011
ubuntu USN-608-1
vupen ADV-2008-1370
xf kde-startkdeinit-privilege-escalation(42039)
statements via4
contributor Joshua Bressers
lastmodified 2008-05-01
organization Red Hat
statement Not vulnerable. This issue did not affect versions of KDE as shipped with Red Hat Enterprise Linux 2.1, 3, 4, or 5.
Last major update 07-03-2011 - 22:07
Published 28-04-2008 - 13:05
Last modified 07-08-2017 - 21:30
Back to Top