[ GLSA 200503-22 ] KDE: Local Denial of Service

[GLSA]

Gentoo Linux Security Advisory

Title: KDE: Local Denial of Service (GLSA 200503-22)
Severity: normal
Exploitable: local
Date: March 19, 2005
Bug(s): #83814
ID: 200503-22

Synopsis

KDE is vulnerable to a local Denial of Service attack.

Background

KDE is a feature-rich graphical desktop environment for Linux and Unix-like Operating Systems. DCOP is KDE's simple IPC/RPC mechanism.

Affected Packages

Package: kde-base/kdelibs
Vulnerable: < 3.3.2-r7
Unaffected: >= 3.3.2-r7
Unaffected: >= 3.2.3-r8 < 3.2.4
Architectures: All supported architectures


Description

Sebastian Krahmer discovered that it is possible to stall the dcopserver of other users.

Impact

An attacker could exploit this to cause a local Denial of Service by stalling the dcopserver in the authentication process. As a result all desktop functionality relying on DCOP will cease to function.

Workaround

There is no known workaround at this time.

Resolution

All kdelibs users should upgrade to the latest version: