----------------------------------------------------------------------


Looking for a job?


Secunia is hiring skilled researchers and talented developers.


http://secunia.com/company/jobs/


----------------------------------------------------------------------

TITLE:
KDE KGet Insecure File Operation and Directory Traversal

SECUNIA ADVISORY ID:
SA39528

VERIFY ADVISORY:
http://secunia.com/advisories/39528/

DESCRIPTION:
Secunia Research has discovered two vulnerabilities in KDE, which can
be exploited by malicious people to bypass certain security features
and to compromise a user's system.

1) KGet does not properly sanitise the "name" attribute of the "file"
element of metalink files before using it to download files. If a user
is tricked into downloading from a specially crafted metalink file,
this can be exploited to download files to directories outside of the
intended download directory via directory traversal attacks.

2) When KGet displays a dialog box that allows a user to choose the
file to download out of the options offered by a metalink file, KGet
simply goes ahead and starts downloading the file without the user's
acknowledgment, overwriting existing files of the same name.

NOTE: These vulnerabilities can be exploited in combination to write
or overwrite an arbitrary file in an arbitrary location on the users
filesystem.

The vulnerabilities are confirmed in KGet version 2.4.2 as included
by KDE 4.4.2. Other versions may also be affected.

SOLUTION:
Apply the patches.

KDE 4.3:
Apply r1126227
svn://anonsvn.kde.org/home/kde/branches/KDE/4.3/kdenetwork

KDE 4.4:
Apply r1124974
svn://anonsvn.kde.org/home/kde/branches/KDE/4.4/kdenetwork

PROVIDED AND/OR DISCOVERED BY:
Stefan Cornelius, Secunia Research

ORIGINAL ADVISORY:
Secunia Research:
http://secunia.com/secunia_research/2010-69/
http://secunia.com/secunia_research/2010-70/

KDE:
http://kde.org/info/security/advisory-20100513-1.txt

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
private users keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/advisories/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------

Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org

----------------------------------------------------------------------