Aviso de seguridad de Debian

DSA-237-1 kdenetwork -- varias vulnerabilidades

Fecha del informe:
22 de ene de 2003
Paquetes afectados:
kdenetwork
Vulnerable:
Referencias a bases de datos de seguridad:
En el diccionario CVE de Mitre: CVE-2002-1393.
Información adicional:

El equipo de KDE descubrió varias vulnerabilidades en el entorno de escritorio K. En algunas ocasiones, KDE fallaba al entrecomillar los parámetros de las instrucciones que se pasaban a un comando por la shell para ser ejecutadas. Estos parámetros podían incorporar datos como URLs, nombres de archivos y direcciones de correo electrónico, y estos datos se podían capturar remotamente cuando la víctima accedía al correo electrónico, una página web, archivos de un sistema de archivos de red o cualquier otra fuente no fiable.

Modificando adecuadamente tales datos, un atancante podía ser capaz de ejecutar comandos arbitrarios en un sistema vulnerable usando los privilegios y la cuenta de la víctima. El proyecto KDE desconoce la existencia de explotaciones para estas vulnerabilidades. Los parches también proporcionan una protección más segura y comprobación de datos más estricta desde fuentes no fiables en múltiples sitios.

Para la distribución estable actual (woody), estos problemas se han corregido en la versión 2.2.2-14.6.

La distribución estable anterior (potato) no contiene ningún paquete de KDE.

Para la distribución inestable (sid), estos problemas probablemente no se corregirán, ya que se espera que los paquetes de KDE 3.1 estén disponibles este año.

Le recomendamos que actualice los paquetes de KDE.

Arreglado en:

Debian GNU/Linux 3.0 (woody)

Fuentes:
http://security.debian.org/pool/updates/main/k/kdenetwork/kdenetwork_2.2.2-14.6.dsc
http://security.debian.org/pool/updates/main/k/kdenetwork/kdenetwork_2.2.2-14.6.diff.gz
http://security.debian.org/pool/updates/main/k/kdenetwork/kdenetwork_2.2.2.orig.tar.gz
Alpha:
http://security.debian.org/pool/updates/main/k/kdenetwork/kdict_2.2.2-14.6_alpha.deb
http://security.debian.org/pool/updates/main/k/kdenetwork/kit_2.2.2-14.6_alpha.deb
http://security.debian.org/pool/updates/main/k/kdenetwork/klisa_2.2.2-14.6_alpha.deb
http://security.debian.org/pool/updates/main/k/kdenetwork/kmail_2.2.2-14.6_alpha.deb
http://security.debian.org/pool/updates/main/k/kdenetwork/knewsticker_2.2.2-14.6_alpha.deb
http://security.debian.org/pool/updates/main/k/kdenetwork/knode_2.2.2-14.6_alpha.deb
http://security.debian.org/pool/updates/main/k/kdenetwork/korn_2.2.2-14.6_alpha.deb
http://security.debian.org/pool/updates/main/k/kdenetwork/kppp_2.2.2-14.6_alpha.deb
http://security.debian.org/pool/updates/main/k/kdenetwork/ksirc_2.2.2-14.6_alpha.deb
http://security.debian.org/pool/updates/main/k/kdenetwork/ktalkd_2.2.2-14.6_alpha.deb
http://security.debian.org/pool/updates/main/k/kdenetwork/libkdenetwork1_2.2.2-14.6_alpha.deb
http://security.debian.org/pool/updates/main/k/kdenetwork/libmimelib-dev_2.2.2-14.6_alpha.deb
http://security.debian.org/pool/updates/main/k/kdenetwork/libmimelib1_2.2.2-14.6_alpha.deb
ARM:
http://security.debian.org/pool/updates/main/k/kdenetwork/kdict_2.2.2-14.6_arm.deb
http://security.debian.org/pool/updates/main/k/kdenetwork/kit_2.2.2-14.6_arm.deb
http://security.debian.org/pool/updates/main/k/kdenetwork/klisa_2.2.2-14.6_arm.deb
http://security.debian.org/pool/updates/main/k/kdenetwork/kmail_2.2.2-14.6_arm.deb
http://security.debian.org/pool/updates/main/k/kdenetwork/knewsticker_2.2.2-14.6_arm.deb
http://security.debian.org/pool/updates/main/k/kdenetwork/knode_2.2.2-14.6_arm.deb
http://security.debian.org/pool/updates/main/k/kdenetwork/korn_2.2.2-14.6_arm.deb
http://security.debian.org/pool/updates/main/k/kdenetwork/kppp_2.2.2-14.6_arm.deb
http://security.debian.org/pool/updates/main/k/kdenetwork/ksirc_2.2.2-14.6_arm.deb
http://security.debian.org/pool/updates/main/k/kdenetwork/ktalkd_2.2.2-14.6_arm.deb
http://security.debian.org/pool/updates/main/k/kdenetwork/libkdenetwork1_2.2.2-14.6_arm.deb
http://security.debian.org/pool/updates/main/k/kdenetwork/libmimelib-dev_2.2.2-14.6_arm.deb
http://security.debian.org/pool/updates/main/k/kdenetwork/libmimelib1_2.2.2-14.6_arm.deb
Intel IA-32:
http://security.debian.org/pool/updates/main/k/kdenetwork/kdict_2.2.2-14.6_i386.deb
http://security.debian.org/pool/updates/main/k/kdenetwork/kit_2.2.2-14.6_i386.deb
http://security.debian.org/pool/updates/main/k/kdenetwork/klisa_2.2.2-14.6_i386.deb
http://security.debian.org/pool/updates/main/k/kdenetwork/kmail_2.2.2-14.6_i386.deb
http://security.debian.org/pool/updates/main/k/kdenetwork/knewsticker_2.2.2-14.6_i386.deb
http://security.debian.org/pool/updates/main/k/kdenetwork/knode_2.2.2-14.6_i386.deb
http://security.debian.org/pool/updates/main/k/kdenetwork/korn_2.2.2-14.6_i386.deb
http://security.debian.org/pool/updates/main/k/kdenetwork/kppp_2.2.2-14.6_i386.deb
http://security.debian.org/pool/updates/main/k/kdenetwork/ksirc_2.2.2-14.6_i386.deb
http://security.debian.org/pool/updates/main/k/kdenetwork/ktalkd_2.2.2-14.6_i386.deb
http://security.debian.org/pool/updates/main/k/kdenetwork/libkdenetwork1_2.2.2-14.6_i386.deb
http://security.debian.org/pool/updates/main/k/kdenetwork/libmimelib-dev_2.2.2-14.6_i386.deb
http://security.debian.org/pool/updates/main/k/kdenetwork/libmimelib1_2.2.2-14.6_i386.deb
Intel IA-64:
http://security.debian.org/pool/updates/main/k/kdenetwork/kdict_2.2.2-14.6_ia64.deb
http://security.debian.org/pool/updates/main/k/kdenetwork/kit_2.2.2-14.6_ia64.deb
http://security.debian.org/pool/updates/main/k/kdenetwork/klisa_2.2.2-14.6_ia64.deb
http://security.debian.org/pool/updates/main/k/kdenetwork/kmail_2.2.2-14.6_ia64.deb
http://security.debian.org/pool/updates/main/k/kdenetwork/knewsticker_2.2.2-14.6_ia64.deb
http://security.debian.org/pool/updates/main/k/kdenetwork/knode_2.2.2-14.6_ia64.deb
http://security.debian.org/pool/updates/main/k/kdenetwork/korn_2.2.2-14.6_ia64.deb
http://security.debian.org/pool/updates/main/k/kdenetwork/kppp_2.2.2-14.6_ia64.deb
http://security.debian.org/pool/updates/main/k/kdenetwork/ksirc_2.2.2-14.6_ia64.deb
http://security.debian.org/pool/updates/main/k/kdenetwork/ktalkd_2.2.2-14.6_ia64.deb
http://security.debian.org/pool/updates/main/k/kdenetwork/libkdenetwork1_2.2.2-14.6_ia64.deb
http://security.debian.org/pool/updates/main/k/kdenetwork/libmimelib-dev_2.2.2-14.6_ia64.deb
http://security.debian.org/pool/updates/main/k/kdenetwork/libmimelib1_2.2.2-14.6_ia64.deb
HPPA:
http://security.debian.org/pool/updates/main/k/kdenetwork/kdict_2.2.2-14.6_hppa.deb
http://security.debian.org/pool/updates/main/k/kdenetwork/kit_2.2.2-14.6_hppa.deb
http://security.debian.org/pool/updates/main/k/kdenetwork/klisa_2.2.2-14.6_hppa.deb
http://security.debian.org/pool/updates/main/k/kdenetwork/kmail_2.2.2-14.6_hppa.deb
http://security.debian.org/pool/updates/main/k/kdenetwork/knewsticker_2.2.2-14.6_hppa.deb
http://security.debian.org/pool/updates/main/k/kdenetwork/knode_2.2.2-14.6_hppa.deb
http://security.debian.org/pool/updates/main/k/kdenetwork/korn_2.2.2-14.6_hppa.deb
http://security.debian.org/pool/updates/main/k/kdenetwork/kppp_2.2.2-14.6_hppa.deb
http://security.debian.org/pool/updates/main/k/kdenetwork/ksirc_2.2.2-14.6_hppa.deb
http://security.debian.org/pool/updates/main/k/kdenetwork/ktalkd_2.2.2-14.6_hppa.deb
http://security.debian.org/pool/updates/main/k/kdenetwork/libkdenetwork1_2.2.2-14.6_hppa.deb
http://security.debian.org/pool/updates/main/k/kdenetwork/libmimelib-dev_2.2.2-14.6_hppa.deb
http://security.debian.org/pool/updates/main/k/kdenetwork/libmimelib1_2.2.2-14.6_hppa.deb
Motorola 680x0:
http://security.debian.org/pool/updates/main/k/kdenetwork/kdict_2.2.2-14.6_m68k.deb
http://security.debian.org/pool/updates/main/k/kdenetwork/kit_2.2.2-14.6_m68k.deb
http://security.debian.org/pool/updates/main/k/kdenetwork/klisa_2.2.2-14.6_m68k.deb
http://security.debian.org/pool/updates/main/k/kdenetwork/kmail_2.2.2-14.6_m68k.deb
http://security.debian.org/pool/updates/main/k/kdenetwork/knewsticker_2.2.2-14.6_m68k.deb
http://security.debian.org/pool/updates/main/k/kdenetwork/knode_2.2.2-14.6_m68k.deb
http://security.debian.org/pool/updates/main/k/kdenetwork/korn_2.2.2-14.6_m68k.deb
http://security.debian.org/pool/updates/main/k/kdenetwork/kppp_2.2.2-14.6_m68k.deb
http://security.debian.org/pool/updates/main/k/kdenetwork/ksirc_2.2.2-14.6_m68k.deb
http://security.debian.org/pool/updates/main/k/kdenetwork/ktalkd_2.2.2-14.6_m68k.deb
http://security.debian.org/pool/updates/main/k/kdenetwork/libkdenetwork1_2.2.2-14.6_m68k.deb
http://security.debian.org/pool/updates/main/k/kdenetwork/libmimelib-dev_2.2.2-14.6_m68k.deb
http://security.debian.org/pool/updates/main/k/kdenetwork/libmimelib1_2.2.2-14.6_m68k.deb
Big endian MIPS:
http://security.debian.org/pool/updates/main/k/kdenetwork/kdict_2.2.2-14.6_mips.deb
http://security.debian.org/pool/updates/main/k/kdenetwork/kit_2.2.2-14.6_mips.deb
http://security.debian.org/pool/updates/main/k/kdenetwork/klisa_2.2.2-14.6_mips.deb
http://security.debian.org/pool/updates/main/k/kdenetwork/kmail_2.2.2-14.6_mips.deb
http://security.debian.org/pool/updates/main/k/kdenetwork/knewsticker_2.2.2-14.6_mips.deb
http://security.debian.org/pool/updates/main/k/kdenetwork/knode_2.2.2-14.6_mips.deb
http://security.debian.org/pool/updates/main/k/kdenetwork/korn_2.2.2-14.6_mips.deb
http://security.debian.org/pool/updates/main/k/kdenetwork/kppp_2.2.2-14.6_mips.deb
http://security.debian.org/pool/updates/main/k/kdenetwork/ksirc_2.2.2-14.6_mips.deb
http://security.debian.org/pool/updates/main/k/kdenetwork/ktalkd_2.2.2-14.6_mips.deb
http://security.debian.org/pool/updates/main/k/kdenetwork/libkdenetwork1_2.2.2-14.6_mips.deb
http://security.debian.org/pool/updates/main/k/kdenetwork/libmimelib-dev_2.2.2-14.6_mips.deb
http://security.debian.org/pool/updates/main/k/kdenetwork/libmimelib1_2.2.2-14.6_mips.deb
Little endian MIPS:
http://security.debian.org/pool/updates/main/k/kdenetwork/kdict_2.2.2-14.6_mipsel.deb
http://security.debian.org/pool/updates/main/k/kdenetwork/kit_2.2.2-14.6_mipsel.deb
http://security.debian.org/pool/updates/main/k/kdenetwork/klisa_2.2.2-14.6_mipsel.deb
http://security.debian.org/pool/updates/main/k/kdenetwork/kmail_2.2.2-14.6_mipsel.deb
http://security.debian.org/pool/updates/main/k/kdenetwork/knewsticker_2.2.2-14.6_mipsel.deb
http://security.debian.org/pool/updates/main/k/kdenetwork/knode_2.2.2-14.6_mipsel.deb
http://security.debian.org/pool/updates/main/k/kdenetwork/korn_2.2.2-14.6_mipsel.deb
http://security.debian.org/pool/updates/main/k/kdenetwork/kppp_2.2.2-14.6_mipsel.deb
http://security.debian.org/pool/updates/main/k/kdenetwork/ksirc_2.2.2-14.6_mipsel.deb
http://security.debian.org/pool/updates/main/k/kdenetwork/ktalkd_2.2.2-14.6_mipsel.deb
http://security.debian.org/pool/updates/main/k/kdenetwork/libkdenetwork1_2.2.2-14.6_mipsel.deb
http://security.debian.org/pool/updates/main/k/kdenetwork/libmimelib-dev_2.2.2-14.6_mipsel.deb
http://security.debian.org/pool/updates/main/k/kdenetwork/libmimelib1_2.2.2-14.6_mipsel.deb
PowerPC:
http://security.debian.org/pool/updates/main/k/kdenetwork/kdict_2.2.2-14.6_powerpc.deb
http://security.debian.org/pool/updates/main/k/kdenetwork/kit_2.2.2-14.6_powerpc.deb
http://security.debian.org/pool/updates/main/k/kdenetwork/klisa_2.2.2-14.6_powerpc.deb
http://security.debian.org/pool/updates/main/k/kdenetwork/kmail_2.2.2-14.6_powerpc.deb
http://security.debian.org/pool/updates/main/k/kdenetwork/knewsticker_2.2.2-14.6_powerpc.deb
http://security.debian.org/pool/updates/main/k/kdenetwork/knode_2.2.2-14.6_powerpc.deb
http://security.debian.org/pool/updates/main/k/kdenetwork/korn_2.2.2-14.6_powerpc.deb
http://security.debian.org/pool/updates/main/k/kdenetwork/kppp_2.2.2-14.6_powerpc.deb
http://security.debian.org/pool/updates/main/k/kdenetwork/ksirc_2.2.2-14.6_powerpc.deb
http://security.debian.org/pool/updates/main/k/kdenetwork/ktalkd_2.2.2-14.6_powerpc.deb
http://security.debian.org/pool/updates/main/k/kdenetwork/libkdenetwork1_2.2.2-14.6_powerpc.deb
http://security.debian.org/pool/updates/main/k/kdenetwork/libmimelib-dev_2.2.2-14.6_powerpc.deb
http://security.debian.org/pool/updates/main/k/kdenetwork/libmimelib1_2.2.2-14.6_powerpc.deb
IBM S/390:
http://security.debian.org/pool/updates/main/k/kdenetwork/kdict_2.2.2-14.6_s390.deb
http://security.debian.org/pool/updates/main/k/kdenetwork/kit_2.2.2-14.6_s390.deb
http://security.debian.org/pool/updates/main/k/kdenetwork/klisa_2.2.2-14.6_s390.deb
http://security.debian.org/pool/updates/main/k/kdenetwork/kmail_2.2.2-14.6_s390.deb
http://security.debian.org/pool/updates/main/k/kdenetwork/knewsticker_2.2.2-14.6_s390.deb
http://security.debian.org/pool/updates/main/k/kdenetwork/knode_2.2.2-14.6_s390.deb
http://security.debian.org/pool/updates/main/k/kdenetwork/korn_2.2.2-14.6_s390.deb
http://security.debian.org/pool/updates/main/k/kdenetwork/kppp_2.2.2-14.6_s390.deb
http://security.debian.org/pool/updates/main/k/kdenetwork/ksirc_2.2.2-14.6_s390.deb
http://security.debian.org/pool/updates/main/k/kdenetwork/ktalkd_2.2.2-14.6_s390.deb
http://security.debian.org/pool/updates/main/k/kdenetwork/libkdenetwork1_2.2.2-14.6_s390.deb
http://security.debian.org/pool/updates/main/k/kdenetwork/libmimelib-dev_2.2.2-14.6_s390.deb
http://security.debian.org/pool/updates/main/k/kdenetwork/libmimelib1_2.2.2-14.6_s390.deb
Sun Sparc:
http://security.debian.org/pool/updates/main/k/kdenetwork/kdict_2.2.2-14.6_sparc.deb
http://security.debian.org/pool/updates/main/k/kdenetwork/kit_2.2.2-14.6_sparc.deb
http://security.debian.org/pool/updates/main/k/kdenetwork/klisa_2.2.2-14.6_sparc.deb
http://security.debian.org/pool/updates/main/k/kdenetwork/kmail_2.2.2-14.6_sparc.deb
http://security.debian.org/pool/updates/main/k/kdenetwork/knewsticker_2.2.2-14.6_sparc.deb
http://security.debian.org/pool/updates/main/k/kdenetwork/knode_2.2.2-14.6_sparc.deb
http://security.debian.org/pool/updates/main/k/kdenetwork/korn_2.2.2-14.6_sparc.deb
http://security.debian.org/pool/updates/main/k/kdenetwork/kppp_2.2.2-14.6_sparc.deb
http://security.debian.org/pool/updates/main/k/kdenetwork/ksirc_2.2.2-14.6_sparc.deb
http://security.debian.org/pool/updates/main/k/kdenetwork/ktalkd_2.2.2-14.6_sparc.deb
http://security.debian.org/pool/updates/main/k/kdenetwork/libkdenetwork1_2.2.2-14.6_sparc.deb
http://security.debian.org/pool/updates/main/k/kdenetwork/libmimelib-dev_2.2.2-14.6_sparc.deb
http://security.debian.org/pool/updates/main/k/kdenetwork/libmimelib1_2.2.2-14.6_sparc.deb

Las sumas MD5 de los ficheros que se listan están disponibles en el aviso original.