A flaw was discovered affecting Kate, the KDE advanced text editor, and Kwrite. Depending on system settings it may be possible for a local user to read the backup files created by Kate or Kwrite. The Common Vulnerabilities and Exposures project assigned the name CVE-2005-1920 to this issue.

Users of Kate or Kwrite should update to this erratum package which contains a backported patch from the KDE security team correcting this issue.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The Kate and Kwrite programs create a file backup before saving a modified file. These backup files are created with default system permissions, even if the original file had more strict permissions set.

The updated packages have been patched to address this issue.

Kate and Kwrite create a backup file before saving a modified file.
These backup files were created with default permissions, even if the original file had more strict permissions set, so that other local users could possibly read the backup file even if they are not permitted to read the original file.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated kdelibs packages are now available for Red Hat Enterprise Linux 4.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

kdelibs contains libraries for the K Desktop Environment.

A flaw was discovered affecting Kate, the KDE advanced text editor, and Kwrite. Depending on system settings, it may be possible for a local user to read the backup files created by Kate or Kwrite. The Common Vulnerabilities and Exposures project assigned the name CVE-2005-1920 to this issue.

Please note this issue does not affect Red Hat Enterprise Linux 3 or 2.1.

Users of Kate or Kwrite should update to these errata packages which contains a backported patch from the KDE security team correcting this issue.

A KDE Security Advisory explains :

Kate / Kwrite create a file backup before saving a modified file.
These backup files are created with default permissions, even if the original file had more strict permissions set.

Depending on the system security settings, backup files might be readable by other users. Kate / Kwrite are network transparent applications and therefore this vulnerability might not be restricted to local users.

KDE developers have reported a vulnerability in the backup file handling of Kate and Kwrite. The backup files are created with default permissions, even if the original file had more strict permissions set. This could disclose information unintendedly.

The remote host is affected by the vulnerability described in GLSA-200611-21 (Kile: Incorrect backup file permission)

    Kile fails to set the same permissions on backup files as on the     original file. This is similar to CVE-2005-1920.
  Impact :

    A kile user may inadvertently grant access to sensitive information.
  Workaround :

    There is no known workaround at this time.

ID	名稱	產品	系列	已發布	已更新	嚴重性
19230	Fedora Core 3 : kdelibs-3.3.1-2.14.FC3 (2005-594)	Nessus	Fedora Local Security Checks	2005/7/20	2021/1/11	medium
19265	Mandrake Linux Security Advisory : kdelibs (MDKSA-2005:122)	Nessus	Mandriva Local Security Checks	2005/7/21	2021/1/6	medium
20548	Ubuntu 5.04 : kdelibs vulnerability (USN-150-1)	Nessus	Ubuntu Local Security Checks	2006/1/15	2021/1/19	medium
19332	RHEL 4 : kdelibs (RHSA-2005:612)	Nessus	Red Hat Local Security Checks	2005/7/31	2021/1/14	medium
21953	CentOS 4 : kdelibs (CESA-2005:612)	Nessus	CentOS Local Security Checks	2006/7/5	2021/1/4	medium
19338	FreeBSD : kdebase -- Kate backup file permission leak (2e116ba5-f7c3-11d9-928e-000b5d7e6dd5)	Nessus	FreeBSD Local Security Checks	2005/8/1	2021/1/6	medium
19611	Debian DSA-804-1 : kdelibs - insecure permissions	Nessus	Debian Local Security Checks	2005/9/12	2021/1/4	medium
23729	GLSA-200611-21 : Kile: Incorrect backup file permission	Nessus	Gentoo Local Security Checks	2006/11/27	2021/1/6	medium

偵測

搜尋 Plugin

medium

medium

medium

medium

medium

medium

medium

medium