KDE: Local Denial of Service — GLSA 200503-22

KDE is vulnerable to a local Denial of Service attack.

Affected Packages

kde-base/kdelibs on all architectures
Affected versions < 3.3.2-r7
Unaffected versions >= 3.3.2-r7, revision >= 3.2.3-r8

Background

KDE is a feature-rich graphical desktop environment for Linux and Unix-like Operating Systems. DCOP is KDE's simple IPC/RPC mechanism.

Description

Sebastian Krahmer discovered that it is possible to stall the dcopserver of other users.

Impact

An attacker could exploit this to cause a local Denial of Service by stalling the dcopserver in the authentication process. As a result all desktop functionality relying on DCOP will cease to function.

Workaround

There is no known workaround at this time.

Resolution

All kdelibs users should upgrade to the latest version:

 # emerge --sync
 # emerge --ask --oneshot --verbose kde-base/kdelibs

References

Release Date
March 19, 2005

Latest Revision
March 19, 2005: 01

Severity
normal

Exploitable
local

Bugzilla entries