OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
debian-security-announce_at_lists.debian.org
Date: Thu Jan 23 2003 - 09:56:44 CST

  • Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

    -----BEGIN PGP SIGNED MESSAGE-----
    Hash: SHA1

    - --------------------------------------------------------------------------
    Debian Security Advisory DSA 239-1 securitydebian.org
    http://www.debian.org/security/ Martin Schulze
    January 23rd, 2003 http://www.debian.org/security/faq
    - --------------------------------------------------------------------------

    Package : kdesdk
    Vulnerability : several
    Problem-type : local, remote
    Debian-specific: no
    CVE Id : CAN-2002-1393

    The KDE team discovered several vulnerabilities in the K Desktop
    Environment. In some instances KDE fails to properly quote parameters
    of instructions passed to a command shell for execution. These
    parameters may incorporate data such as URLs, filenames and e-mail
    addresses, and this data may be provided remotely to a victim in an
    e-mail, a webpage or files on a network filesystem or other untrusted
    source.

    By carefully crafting such data an attacker might be able to execute
    arbitary commands on a vulnerable sytem using the victim's account and
    privileges. The KDE Project is not aware of any existing exploits of
    these vulnerabilities. The patches also provide better safe guards
    and check data from untrusted sources more strictly in multiple
    places.

    For the current stable distribution (woody), these problems have been fixed
    in version 2.2.2-3.2.

    The old stable distribution (potato) does not contain KDE packages.

    For the unstable distribution (sid), these problems will most probably
    not be fixed but new packages for KDE 3.1 for sid are expected for
    this year.

    We recommend that you upgrade your KDE packages.

    Upgrade Instructions
    - --------------------

    wget url
            will fetch the file for you
    dpkg -i file.deb
            will install the referenced file.

    If you are using the apt-get package manager, use the line for
    sources.list as given below:

    apt-get update
            will update the internal database
    apt-get upgrade
            will install corrected packages

    You may use an automated update by adding the resources from the
    footer to the proper configuration.

    Debian GNU/Linux 3.0 alias woody
    - --------------------------------

      Source archives:

        http://security.debian.org/pool/updates/main/k/kdesdk/kdesdk_2.2.2-3.2.dsc
          Size/MD5 checksum: 809 1e72a255b00079ba8e293a4ceb1c8eb3
        http://security.debian.org/pool/updates/main/k/kdesdk/kdesdk_2.2.2-3.2.diff.gz
          Size/MD5 checksum: 2645 1f41391569ee52599dc843687a03181e
        http://security.debian.org/pool/updates/main/k/kdesdk/kdesdk_2.2.2.orig.tar.gz
          Size/MD5 checksum: 1360120 27bc6f7baf89e63fc6913772769920df

      Architecture independent components:

        http://security.debian.org/pool/updates/main/k/kdesdk/kapptemplate_2.2.2-3.2_all.deb
          Size/MD5 checksum: 250626 a8e193b6c246f9038bd0b1634e8628c0
        http://security.debian.org/pool/updates/main/k/kdesdk/kdepalettes_2.2.2-3.2_all.deb
          Size/MD5 checksum: 5836 d426f27006ee16b366e7aea58535ab3f
        http://security.debian.org/pool/updates/main/k/kdesdk/kdesdk-doc_2.2.2-3.2_all.deb
          Size/MD5 checksum: 126968 30f7976922e912f7ced3b4c5252241df
        http://security.debian.org/pool/updates/main/k/kdesdk/kdesdk-scripts_2.2.2-3.2_all.deb
          Size/MD5 checksum: 66716 1c1b8276651620280b31cf892a10a6e7

      Alpha architecture:

        http://security.debian.org/pool/updates/main/k/kdesdk/kbabel_2.2.2-3.2_alpha.deb
          Size/MD5 checksum: 859876 2d1f134832246f016708c9b5869b2e6b
        http://security.debian.org/pool/updates/main/k/kdesdk/kbabel-dev_2.2.2-3.2_alpha.deb
          Size/MD5 checksum: 21394 4bccd516498a581fae81f4f0a86a91c9
        http://security.debian.org/pool/updates/main/k/kdesdk/kdesdk_2.2.2-3.2_alpha.deb
          Size/MD5 checksum: 4812 8003ab13861e310bcc912fccc8fcd2ca
        http://security.debian.org/pool/updates/main/k/kdesdk/kexample_2.2.2-3.2_alpha.deb
          Size/MD5 checksum: 27588 891cb9ed18b7fcbf0dbcd6d81777d04a
        http://security.debian.org/pool/updates/main/k/kdesdk/kmtrace_2.2.2-3.2_alpha.deb
          Size/MD5 checksum: 63782 972cec3713037b485e993dddf0b4d38a
        http://security.debian.org/pool/updates/main/k/kdesdk/kspy_2.2.2-3.2_alpha.deb
          Size/MD5 checksum: 31528 de61d755227fbc982af96b3d1823f238
        http://security.debian.org/pool/updates/main/k/kdesdk/kstartperf_2.2.2-3.2_alpha.deb
          Size/MD5 checksum: 14632 528754318b469f61e61bd239576c629c
        http://security.debian.org/pool/updates/main/k/kdesdk/poxml_2.2.2-3.2_alpha.deb
          Size/MD5 checksum: 646068 8215138bec95fce13579ddeb57835363

      ARM architecture:

        http://security.debian.org/pool/updates/main/k/kdesdk/kbabel_2.2.2-3.2_arm.deb
          Size/MD5 checksum: 774294 7be484e4e531bada235675670656f7ad
        http://security.debian.org/pool/updates/main/k/kdesdk/kbabel-dev_2.2.2-3.2_arm.deb
          Size/MD5 checksum: 21392 a106a49607929471e8d0fbfda42b7302
        http://security.debian.org/pool/updates/main/k/kdesdk/kdesdk_2.2.2-3.2_arm.deb
          Size/MD5 checksum: 4814 c659f7dba60b8d00ff8f6e9c0d7f1d87
        http://security.debian.org/pool/updates/main/k/kdesdk/kexample_2.2.2-3.2_arm.deb
          Size/MD5 checksum: 25996 2fc418708a8c880c5aecc45cbde1c2ec
        http://security.debian.org/pool/updates/main/k/kdesdk/kmtrace_2.2.2-3.2_arm.deb
          Size/MD5 checksum: 58904 34211e1af64b8a80aa39149480f07c74
        http://security.debian.org/pool/updates/main/k/kdesdk/kspy_2.2.2-3.2_arm.deb
          Size/MD5 checksum: 28198 c4f819f1d31987346a979fab5fc8ec2e
        http://security.debian.org/pool/updates/main/k/kdesdk/kstartperf_2.2.2-3.2_arm.deb
          Size/MD5 checksum: 13276 e1a80773b018de47fa2a4247743cb5e5
        http://security.debian.org/pool/updates/main/k/kdesdk/poxml_2.2.2-3.2_arm.deb
          Size/MD5 checksum: 823442 679a0cc8b4716ea12a3431af11c16697

      Intel IA-32 architecture:

        http://security.debian.org/pool/updates/main/k/kdesdk/kbabel_2.2.2-3.2_i386.deb
          Size/MD5 checksum: 771636 398d372af4149eba47689f9b36db7780
        http://security.debian.org/pool/updates/main/k/kdesdk/kbabel-dev_2.2.2-3.2_i386.deb
          Size/MD5 checksum: 21390 4af236cb7cbfb97be9650a5bb0912247
        http://security.debian.org/pool/updates/main/k/kdesdk/kdesdk_2.2.2-3.2_i386.deb
          Size/MD5 checksum: 4812 c3b559f9f7429653181503c179f1f0e4
        http://security.debian.org/pool/updates/main/k/kdesdk/kexample_2.2.2-3.2_i386.deb
          Size/MD5 checksum: 27030 ea6665b84e3e12bf1ea11ce30e086d8a
        http://security.debian.org/pool/updates/main/k/kdesdk/kmtrace_2.2.2-3.2_i386.deb
          Size/MD5 checksum: 52800 068d88ee6551f11a48f51d3973787a39
        http://security.debian.org/pool/updates/main/k/kdesdk/kspy_2.2.2-3.2_i386.deb
          Size/MD5 checksum: 26852 dca10d6aa7f98c468e983e60b1f4b452
        http://security.debian.org/pool/updates/main/k/kdesdk/kstartperf_2.2.2-3.2_i386.deb
          Size/MD5 checksum: 13280 8611af32043773a83bb1cf59bf45c859
        http://security.debian.org/pool/updates/main/k/kdesdk/poxml_2.2.2-3.2_i386.deb
          Size/MD5 checksum: 646918 8cab3553cb420581e5d5d61dc6bb6c32

      Intel IA-64 architecture:

        http://security.debian.org/pool/updates/main/k/kdesdk/kbabel_2.2.2-3.2_ia64.deb
          Size/MD5 checksum: 1081164 adc303bb20b873e1d1111e4bff4b0035
        http://security.debian.org/pool/updates/main/k/kdesdk/kbabel-dev_2.2.2-3.2_ia64.deb
          Size/MD5 checksum: 21398 6adf6c79dcbf70931c1865b649a7cdcb
        http://security.debian.org/pool/updates/main/k/kdesdk/kdesdk_2.2.2-3.2_ia64.deb
          Size/MD5 checksum: 4812 3cc47238e4fc2a13f2f54e617e646d00
        http://security.debian.org/pool/updates/main/k/kdesdk/kexample_2.2.2-3.2_ia64.deb
          Size/MD5 checksum: 29356 b121017c5ed894da3aa55ba8e39c2ba3
        http://security.debian.org/pool/updates/main/k/kdesdk/kmtrace_2.2.2-3.2_ia64.deb
          Size/MD5 checksum: 82626 123f528b9eed10394461baa30243ee51
        http://security.debian.org/pool/updates/main/k/kdesdk/kspy_2.2.2-3.2_ia64.deb
          Size/MD5 checksum: 33162 26c22978b33eeda9cae0d15641302a1e
        http://security.debian.org/pool/updates/main/k/kdesdk/kstartperf_2.2.2-3.2_ia64.deb
          Size/MD5 checksum: 15300 d6b7c27627086e1b5cef53959af9731c
        http://security.debian.org/pool/updates/main/k/kdesdk/poxml_2.2.2-3.2_ia64.deb
          Size/MD5 checksum: 925860 d4ce81bf2af95fe33100df103c21dc7e

      HP Precision architecture:

        http://security.debian.org/pool/updates/main/k/kdesdk/kbabel_2.2.2-3.2_hppa.deb
          Size/MD5 checksum: 889318 bcff53bd4619d49193abe277c09d1506
        http://security.debian.org/pool/updates/main/k/kdesdk/kbabel-dev_2.2.2-3.2_hppa.deb
          Size/MD5 checksum: 21398 5ce6c4922f8c176b969a9c1a96bee298
        http://security.debian.org/pool/updates/main/k/kdesdk/kdesdk_2.2.2-3.2_hppa.deb
          Size/MD5 checksum: 4810 5ab1aa6a25c4939e9c9c8abe65a17d7c
        http://security.debian.org/pool/updates/main/k/kdesdk/kexample_2.2.2-3.2_hppa.deb
          Size/MD5 checksum: 28136 159b6cc8977f5b45cad85e97e9ce117c
        http://security.debian.org/pool/updates/main/k/kdesdk/kmtrace_2.2.2-3.2_hppa.deb
          Size/MD5 checksum: 66134 ac364b2798f4b2307a51529d1bb600db
        http://security.debian.org/pool/updates/main/k/kdesdk/kspy_2.2.2-3.2_hppa.deb
          Size/MD5 checksum: 32966 22ee0f939f8922c25517823214b193bf
        http://security.debian.org/pool/updates/main/k/kdesdk/kstartperf_2.2.2-3.2_hppa.deb
          Size/MD5 checksum: 14020 c16c6dde35ed450d4142cd06527481cd
        http://security.debian.org/pool/updates/main/k/kdesdk/poxml_2.2.2-3.2_hppa.deb
          Size/MD5 checksum: 606434 f71003608b1e050c050069f4d17c226a

      Motorola 680x0 architecture:

        http://security.debian.org/pool/updates/main/k/kdesdk/kbabel_2.2.2-3.2_m68k.deb
          Size/MD5 checksum: 755554 8a29c63753913e33ebde86dcf2d6d392
        http://security.debian.org/pool/updates/main/k/kdesdk/kbabel-dev_2.2.2-3.2_m68k.deb
          Size/MD5 checksum: 21412 da1079065eebd18a353a66a61cd4dee1
        http://security.debian.org/pool/updates/main/k/kdesdk/kdesdk_2.2.2-3.2_m68k.deb
          Size/MD5 checksum: 4824 8f8a296e9cb9809992ee775afbf3fd18
        http://security.debian.org/pool/updates/main/k/kdesdk/kexample_2.2.2-3.2_m68k.deb
          Size/MD5 checksum: 27516 5d50b2f558e0c762ee5c2dfc99fa7f6e
        http://security.debian.org/pool/updates/main/k/kdesdk/kmtrace_2.2.2-3.2_m68k.deb
          Size/MD5 checksum: 49072 fbe18a9d85c5f8412b73d6b525fc9739
        http://security.debian.org/pool/updates/main/k/kdesdk/kspy_2.2.2-3.2_m68k.deb
          Size/MD5 checksum: 30292 4bf09fa1bd8cc6de9c16159ecd3ae589
        http://security.debian.org/pool/updates/main/k/kdesdk/kstartperf_2.2.2-3.2_m68k.deb
          Size/MD5 checksum: 13366 438135879b2780246d418743f9a9fd3d
        http://security.debian.org/pool/updates/main/k/kdesdk/poxml_2.2.2-3.2_m68k.deb
          Size/MD5 checksum: 572830 43978d2e9e5361e5961e8ff54063faa6

      Big endian MIPS architecture:

        http://security.debian.org/pool/updates/main/k/kdesdk/kbabel_2.2.2-3.2_mips.deb
          Size/MD5 checksum: 732348 3a20102bd3df1b16a1c383925ff280ea
        http://security.debian.org/pool/updates/main/k/kdesdk/kbabel-dev_2.2.2-3.2_mips.deb
          Size/MD5 checksum: 21404 c57eb0e4b427557ea08331a1fad33779
        http://security.debian.org/pool/updates/main/k/kdesdk/kdesdk_2.2.2-3.2_mips.deb
          Size/MD5 checksum: 4816 7df152e52a3794b317ecdb434bfd8295
        http://security.debian.org/pool/updates/main/k/kdesdk/kexample_2.2.2-3.2_mips.deb
          Size/MD5 checksum: 25996 4b6716a1024718ab305040fe445794c6
        http://security.debian.org/pool/updates/main/k/kdesdk/kmtrace_2.2.2-3.2_mips.deb
          Size/MD5 checksum: 56908 21b6f8a8f328b37485b4403d0c1b63d3
        http://security.debian.org/pool/updates/main/k/kdesdk/kspy_2.2.2-3.2_mips.deb
          Size/MD5 checksum: 26984 7fb1700bf00e7c136bc541670a6e21a8
        http://security.debian.org/pool/updates/main/k/kdesdk/kstartperf_2.2.2-3.2_mips.deb
          Size/MD5 checksum: 13490 d0ff206692c05683bfc25b8628359430
        http://security.debian.org/pool/updates/main/k/kdesdk/poxml_2.2.2-3.2_mips.deb
          Size/MD5 checksum: 501868 c1b11ebc04ab12231740ba85ff34fab0

      Little endian MIPS architecture:

        http://security.debian.org/pool/updates/main/k/kdesdk/kbabel_2.2.2-3.2_mipsel.deb
          Size/MD5 checksum: 725606 67c6d21460d34f18dabe4b4541da49f0
        http://security.debian.org/pool/updates/main/k/kdesdk/kbabel-dev_2.2.2-3.2_mipsel.deb
          Size/MD5 checksum: 21398 373e5e32b5afc536b654006206925d59
        http://security.debian.org/pool/updates/main/k/kdesdk/kdesdk_2.2.2-3.2_mipsel.deb
          Size/MD5 checksum: 4814 537b6a8c5f982f61a299c429a8e66487
        http://security.debian.org/pool/updates/main/k/kdesdk/kexample_2.2.2-3.2_mipsel.deb
          Size/MD5 checksum: 25926 5c5e4027ef6ca161d15c0088f8ae73e0
        http://security.debian.org/pool/updates/main/k/kdesdk/kmtrace_2.2.2-3.2_mipsel.deb
          Size/MD5 checksum: 56948 2077d42240aa305ceadd620744e4a3af
        http://security.debian.org/pool/updates/main/k/kdesdk/kspy_2.2.2-3.2_mipsel.deb
          Size/MD5 checksum: 26842 3008905abfba7904d5df4fd55a416bdc
        http://security.debian.org/pool/updates/main/k/kdesdk/kstartperf_2.2.2-3.2_mipsel.deb
          Size/MD5 checksum: 13456 1daf24ffefc3abe4bc68fc0b86a8056f
        http://security.debian.org/pool/updates/main/k/kdesdk/poxml_2.2.2-3.2_mipsel.deb
          Size/MD5 checksum: 485800 1e801b8a53fcba4d804a1991ef33f598

      PowerPC architecture:

        http://security.debian.org/pool/updates/main/k/kdesdk/kbabel_2.2.2-3.2_powerpc.deb
          Size/MD5 checksum: 776788 c45a2dca8dcb7cbd34f4d9a19dc4891f
        http://security.debian.org/pool/updates/main/k/kdesdk/kbabel-dev_2.2.2-3.2_powerpc.deb
          Size/MD5 checksum: 21396 0c42f08dd63079eb61dae050629678df
        http://security.debian.org/pool/updates/main/k/kdesdk/kdesdk_2.2.2-3.2_powerpc.deb
          Size/MD5 checksum: 4814 9311209a5ea526e9f24f5c9311865f7b
        http://security.debian.org/pool/updates/main/k/kdesdk/kexample_2.2.2-3.2_powerpc.deb
          Size/MD5 checksum: 25568 eb202cb0741f3d6dac8c56a5364513b3
        http://security.debian.org/pool/updates/main/k/kdesdk/kmtrace_2.2.2-3.2_powerpc.deb
          Size/MD5 checksum: 55920 deccf7c64b24a5d4cd133a03fd0965d1
        http://security.debian.org/pool/updates/main/k/kdesdk/kspy_2.2.2-3.2_powerpc.deb
          Size/MD5 checksum: 27254 0768e4faa8088feb0b0ae96d077f9a73
        http://security.debian.org/pool/updates/main/k/kdesdk/kstartperf_2.2.2-3.2_powerpc.deb
          Size/MD5 checksum: 13480 19e5c0ef57434c581e6609feac1d402e
        http://security.debian.org/pool/updates/main/k/kdesdk/poxml_2.2.2-3.2_powerpc.deb
          Size/MD5 checksum: 597628 ef1f2ff7a37f6a260325aa14156a6293

      IBM S/390 architecture:

        http://security.debian.org/pool/updates/main/k/kdesdk/kbabel_2.2.2-3.2_s390.deb
          Size/MD5 checksum: 786632 823b69607fc4b1a29544308a46b14da5
        http://security.debian.org/pool/updates/main/k/kdesdk/kbabel-dev_2.2.2-3.2_s390.deb
          Size/MD5 checksum: 21396 71a5686e9469e65219adfb5e71b25430
        http://security.debian.org/pool/updates/main/k/kdesdk/kdesdk_2.2.2-3.2_s390.deb
          Size/MD5 checksum: 4812 7bbff9c4a6052f2233add2f024a32357
        http://security.debian.org/pool/updates/main/k/kdesdk/kexample_2.2.2-3.2_s390.deb
          Size/MD5 checksum: 28408 81d705f49ed63cd6c0e06e2d54aba3ab
        http://security.debian.org/pool/updates/main/k/kdesdk/kmtrace_2.2.2-3.2_s390.deb
          Size/MD5 checksum: 56080 e173c5fa1a60090fc88fbd55810f6713
        http://security.debian.org/pool/updates/main/k/kdesdk/kspy_2.2.2-3.2_s390.deb
          Size/MD5 checksum: 28160 e02c2b090c006177af9f79554496d96a
        http://security.debian.org/pool/updates/main/k/kdesdk/kstartperf_2.2.2-3.2_s390.deb
          Size/MD5 checksum: 13626 6cb99ec8320414ff2aae1a021be21038
        http://security.debian.org/pool/updates/main/k/kdesdk/poxml_2.2.2-3.2_s390.deb
          Size/MD5 checksum: 498292 90c93d77364f16bf6bbc6df35bd3f7af

      Sun Sparc architecture:

        http://security.debian.org/pool/updates/main/k/kdesdk/kbabel_2.2.2-3.2_sparc.deb
          Size/MD5 checksum: 782502 4f23c31dd8961b0c14098cb35a14a14c
        http://security.debian.org/pool/updates/main/k/kdesdk/kbabel-dev_2.2.2-3.2_sparc.deb
          Size/MD5 checksum: 21394 e59e9cf5957993d613e0bfc168e2895b
        http://security.debian.org/pool/updates/main/k/kdesdk/kdesdk_2.2.2-3.2_sparc.deb
          Size/MD5 checksum: 4810 96cc1ed9708a39cd1ee98093c4af5aab
        http://security.debian.org/pool/updates/main/k/kdesdk/kexample_2.2.2-3.2_sparc.deb
          Size/MD5 checksum: 26404 d6ddf3c6847c1968f763a5803cad36de
        http://security.debian.org/pool/updates/main/k/kdesdk/kmtrace_2.2.2-3.2_sparc.deb
          Size/MD5 checksum: 55730 697a73daa3bf53170c03b0c2b56ddce4
        http://security.debian.org/pool/updates/main/k/kdesdk/kspy_2.2.2-3.2_sparc.deb
          Size/MD5 checksum: 29364 7a6926422194514084fd3637686313a1
        http://security.debian.org/pool/updates/main/k/kdesdk/kstartperf_2.2.2-3.2_sparc.deb
          Size/MD5 checksum: 13378 69e08fa7cabf50fa2e97f16a8af16192
        http://security.debian.org/pool/updates/main/k/kdesdk/poxml_2.2.2-3.2_sparc.deb
          Size/MD5 checksum: 584010 04dd30e9894dff1b2bbaf709ae6e13e2

      These files will probably be moved into the stable distribution on
      its next revision.

    - ---------------------------------------------------------------------------------
    For apt-get: deb http://security.debian.org/ stable/updates main
    For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main
    Mailing list: debian-security-announcelists.debian.org
    Package info: `apt-cache show <pkg>' and http://packages.debian.org/>

    -----BEGIN PGP SIGNATURE-----
    Version: GnuPG v1.2.1 (GNU/Linux)

    iD8DBQE+MBC8W5ql+IAeqTIRApYDAKC5tA4+xAog6VT2h4oo3haYcc/3JwCaAhax
    YdYE+ygjcd5zdYM+ykq6cmM=
    =kNcy
    -----END PGP SIGNATURE-----

    _______________________________________________
    Full-Disclosure - We believe in it.
    Charter:
    http://lists.netsys.com/full-disclosure-charter.html