Synopsis

kdelibs security update

Type/Severity

Security Advisory: Important

Topic

Updated kdelibs packages that fix several security issues are now available
for Red Hat Enterprise Linux 4.

This update has been rated as having important security impact by the Red
Hat Security Response Team.

Description

The kdelibs package provides libraries for the K Desktop Environment.

The International Domain Name (IDN) support in the Konqueror browser
allowed remote attackers to spoof domain names using punycode encoded
domain names. Such domain names are decoded in URLs and SSL certificates
in a way that uses homograph characters from other character sets, which
facilitates phishing attacks. The Common Vulnerabilities and Exposures
project (cve.mitre.org) has assigned the name CAN-2005-0237 to this issue.

Sebastian Krahmer discovered a flaw in dcopserver, the KDE Desktop
Communication Protocol (DCOP) daemon. A local user could use this flaw to
stall the DCOP authentication process, affecting any local desktop users
and causing a reduction in their desktop functionality. The Common
Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name
CAN-2005-0396 to this issue.

A flaw in the dcopidlng script was discovered. The dcopidlng script would
create temporary files with predictable filenames which could allow local
users to overwrite arbitrary files via a symlink attack. The Common
Vulnerabilities and Exposures project (cve.mitre.org) has assigned
the name CAN-2005-0365 to this issue.

Users of KDE should upgrade to these erratum packages which contain
backported patches to correct these issues.

Solution

Before applying this update, make sure that all previously-released
errata relevant to your system have been applied. Use Red Hat
Network to download and update your packages. To launch the Red Hat
Update Agent, use the following command:

up2date

For information on how to install packages manually, refer to the
following Web page for the System Administration or Customization
guide specific to your system:

http://www.redhat.com/docs/manuals/enterprise/

Affected Products

• Red Hat Enterprise Linux Server 4 x86_64
• Red Hat Enterprise Linux Server 4 ia64
• Red Hat Enterprise Linux Server 4 i386
• Red Hat Enterprise Linux Workstation 4 x86_64
• Red Hat Enterprise Linux Workstation 4 ia64
• Red Hat Enterprise Linux Workstation 4 i386
• Red Hat Enterprise Linux Desktop 4 x86_64
• Red Hat Enterprise Linux Desktop 4 i386
• Red Hat Enterprise Linux for IBM z Systems 4 s390x
• Red Hat Enterprise Linux for IBM z Systems 4 s390
• Red Hat Enterprise Linux for Power, big endian 4 ppc

Fixes

• BZ - 147405 - CAN-2005-0237 homograph spoofing
• BZ - 148822 - CAN-2005-0365 dcopidlng insecure temporary file usage
• BZ - 150090 - CAN-2005-0396 kdelibs DCOP DoS

CVEs

• CVE-2005-0237
• CVE-2005-0365
• CVE-2005-0396

References

• http://www.kde.org/info/security/advisory-20050316-3.txt
• http://www.kde.org/info/security/advisory-20050316-2.txt
• http://www.kde.org/info/security/advisory-20050316-1.txt

Red Hat Enterprise Linux Server 4

SRPM
kdelibs-3.3.1-3.6.src.rpm	SHA-256: 022afb592de90cc0cfefc0448625087cdd966988f3e2e23e85ce74013e1b819a
x86_64
kdelibs-3.3.1-3.6.i386.rpm	SHA-256: 538870491625d33dc2fbc40454e2b825d922b406fbe7af188089f816e3f421ff
kdelibs-3.3.1-3.6.i386.rpm	SHA-256: 538870491625d33dc2fbc40454e2b825d922b406fbe7af188089f816e3f421ff
kdelibs-3.3.1-3.6.x86_64.rpm	SHA-256: d8002961d2e42bbcc63d9af31d3a2139e763e5ac3e434705cab39899a1e43b6d
kdelibs-3.3.1-3.6.x86_64.rpm	SHA-256: d8002961d2e42bbcc63d9af31d3a2139e763e5ac3e434705cab39899a1e43b6d
kdelibs-devel-3.3.1-3.6.x86_64.rpm	SHA-256: 19536d09e563dbd833291d5025ec1d5a5363a4d198b08943955f8ac6b21f28c5
kdelibs-devel-3.3.1-3.6.x86_64.rpm	SHA-256: 19536d09e563dbd833291d5025ec1d5a5363a4d198b08943955f8ac6b21f28c5
ia64
kdelibs-3.3.1-3.6.i386.rpm	SHA-256: 538870491625d33dc2fbc40454e2b825d922b406fbe7af188089f816e3f421ff
kdelibs-3.3.1-3.6.i386.rpm	SHA-256: 538870491625d33dc2fbc40454e2b825d922b406fbe7af188089f816e3f421ff
kdelibs-3.3.1-3.6.ia64.rpm	SHA-256: 4928d0ed0707c94b7154de673d4341af3e1526ff8f95e659949ce9d333a265cd
kdelibs-3.3.1-3.6.ia64.rpm	SHA-256: 4928d0ed0707c94b7154de673d4341af3e1526ff8f95e659949ce9d333a265cd
kdelibs-devel-3.3.1-3.6.ia64.rpm	SHA-256: e2d9fbeb72f71bbb053240e12e0f4cdd4da00ce8b24662742d952269e281ed31
kdelibs-devel-3.3.1-3.6.ia64.rpm	SHA-256: e2d9fbeb72f71bbb053240e12e0f4cdd4da00ce8b24662742d952269e281ed31
i386
kdelibs-3.3.1-3.6.i386.rpm	SHA-256: 538870491625d33dc2fbc40454e2b825d922b406fbe7af188089f816e3f421ff
kdelibs-3.3.1-3.6.i386.rpm	SHA-256: 538870491625d33dc2fbc40454e2b825d922b406fbe7af188089f816e3f421ff
kdelibs-devel-3.3.1-3.6.i386.rpm	SHA-256: 6247b8da4afe41a189a140dd3c3450041f95da972a91f66f39ac7968a940831d
kdelibs-devel-3.3.1-3.6.i386.rpm	SHA-256: 6247b8da4afe41a189a140dd3c3450041f95da972a91f66f39ac7968a940831d

Red Hat Enterprise Linux Workstation 4

SRPM
kdelibs-3.3.1-3.6.src.rpm	SHA-256: 022afb592de90cc0cfefc0448625087cdd966988f3e2e23e85ce74013e1b819a
x86_64
kdelibs-3.3.1-3.6.i386.rpm	SHA-256: 538870491625d33dc2fbc40454e2b825d922b406fbe7af188089f816e3f421ff
kdelibs-3.3.1-3.6.x86_64.rpm	SHA-256: d8002961d2e42bbcc63d9af31d3a2139e763e5ac3e434705cab39899a1e43b6d
kdelibs-devel-3.3.1-3.6.x86_64.rpm	SHA-256: 19536d09e563dbd833291d5025ec1d5a5363a4d198b08943955f8ac6b21f28c5
ia64
kdelibs-3.3.1-3.6.i386.rpm	SHA-256: 538870491625d33dc2fbc40454e2b825d922b406fbe7af188089f816e3f421ff
kdelibs-3.3.1-3.6.ia64.rpm	SHA-256: 4928d0ed0707c94b7154de673d4341af3e1526ff8f95e659949ce9d333a265cd
kdelibs-devel-3.3.1-3.6.ia64.rpm	SHA-256: e2d9fbeb72f71bbb053240e12e0f4cdd4da00ce8b24662742d952269e281ed31
i386
kdelibs-3.3.1-3.6.i386.rpm	SHA-256: 538870491625d33dc2fbc40454e2b825d922b406fbe7af188089f816e3f421ff
kdelibs-devel-3.3.1-3.6.i386.rpm	SHA-256: 6247b8da4afe41a189a140dd3c3450041f95da972a91f66f39ac7968a940831d

Red Hat Enterprise Linux Desktop 4

SRPM
kdelibs-3.3.1-3.6.src.rpm	SHA-256: 022afb592de90cc0cfefc0448625087cdd966988f3e2e23e85ce74013e1b819a
x86_64
kdelibs-3.3.1-3.6.i386.rpm	SHA-256: 538870491625d33dc2fbc40454e2b825d922b406fbe7af188089f816e3f421ff
kdelibs-3.3.1-3.6.x86_64.rpm	SHA-256: d8002961d2e42bbcc63d9af31d3a2139e763e5ac3e434705cab39899a1e43b6d
kdelibs-devel-3.3.1-3.6.x86_64.rpm	SHA-256: 19536d09e563dbd833291d5025ec1d5a5363a4d198b08943955f8ac6b21f28c5
i386
kdelibs-3.3.1-3.6.i386.rpm	SHA-256: 538870491625d33dc2fbc40454e2b825d922b406fbe7af188089f816e3f421ff
kdelibs-devel-3.3.1-3.6.i386.rpm	SHA-256: 6247b8da4afe41a189a140dd3c3450041f95da972a91f66f39ac7968a940831d

Red Hat Enterprise Linux for IBM z Systems 4

SRPM
kdelibs-3.3.1-3.6.src.rpm	SHA-256: 022afb592de90cc0cfefc0448625087cdd966988f3e2e23e85ce74013e1b819a
s390x
kdelibs-3.3.1-3.6.s390.rpm	SHA-256: 58d1342330e6983fec5d5a2a5651ebea7e8ea1310ec72b9e0718c2d1c3338d5d
kdelibs-3.3.1-3.6.s390x.rpm	SHA-256: 7daec2abdeab274650a45300b6d40553d94678a539d9b15da8e12eb423a593e8
kdelibs-devel-3.3.1-3.6.s390x.rpm	SHA-256: 9259cdd8d2e127832d1d887a7aea6dce86837cfa38f2aa207fa67ace381be461
s390
kdelibs-3.3.1-3.6.s390.rpm	SHA-256: 58d1342330e6983fec5d5a2a5651ebea7e8ea1310ec72b9e0718c2d1c3338d5d
kdelibs-devel-3.3.1-3.6.s390.rpm	SHA-256: 98c70b4ff34c254ed621fe5a9223edb58d9a034649782a094e6778652e807858

Red Hat Enterprise Linux for Power, big endian 4

SRPM
kdelibs-3.3.1-3.6.src.rpm	SHA-256: 022afb592de90cc0cfefc0448625087cdd966988f3e2e23e85ce74013e1b819a
ppc
kdelibs-3.3.1-3.6.ppc.rpm	SHA-256: 5475cb223735c6368f98bbdb93e0c058c00db65ec61fab5d64a3302e8be6a0a6
kdelibs-3.3.1-3.6.ppc64.rpm	SHA-256: 66b3960691ddded54de90aa1c9cbdd3f97b74f300c0bef4638f0ecc11b80fb93
kdelibs-devel-3.3.1-3.6.ppc.rpm	SHA-256: effd0ad8a4656c317ddb31e584b8f114d11d8f0cc0b3b2294ffe590d7658ccc1