Synopsis

kdebase security update

Type/Severity

Security Advisory: Important

Topic

Updated kdebase packages that correct a security flaw in kdm are now
available for Red Hat Enterprise Linux 4.

This update has been rated as having important security impact by the Red
Hat Security Response Team.

Description

The kdebase packages provide the core applications for KDE, the K Desktop
Environment. These core packages include the KDE Display Manager (KDM).

Ludwig Nussel discovered a flaw in KDM. A malicious local KDM user could
use a symlink attack to read an arbitrary file that they would not normally
have permissions to read. (CVE-2006-2449)

Note: this issue does not affect the version of KDM as shipped with Red Hat
Enterprise Linux 2.1 or 3.

All users of KDM should upgrade to these updated packages which contain a
backported patch to correct this issue.

Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via Red Hat Network. To use Red Hat Network,
launch the Red Hat Update Agent with the following command:

up2date

This will start an interactive process that will result in the appropriate
RPMs being upgraded on your system.

Affected Products

• Red Hat Enterprise Linux Server 4 x86_64
• Red Hat Enterprise Linux Server 4 ia64
• Red Hat Enterprise Linux Server 4 i386
• Red Hat Enterprise Linux Workstation 4 x86_64
• Red Hat Enterprise Linux Workstation 4 ia64
• Red Hat Enterprise Linux Workstation 4 i386
• Red Hat Enterprise Linux Desktop 4 x86_64
• Red Hat Enterprise Linux Desktop 4 i386
• Red Hat Enterprise Linux for IBM z Systems 4 s390x
• Red Hat Enterprise Linux for IBM z Systems 4 s390
• Red Hat Enterprise Linux for Power, big endian 4 ppc

Fixes

• BZ - 194581 - CVE-2006-2449 kdm file disclosure

CVEs

• CVE-2006-2449

References

• http://www.kde.org/info/security/advisory-20060614-1.txt
• http://www.redhat.com/security/updates/classification/#important

Red Hat Enterprise Linux Server 4

SRPM
kdebase-3.3.1-5.12.src.rpm	SHA-256: e8e295d0ed3c4e37ae58241e59f43ef3bd8743dc2c85543c1eeabfc5dcaa27e9
x86_64
kdebase-3.3.1-5.12.i386.rpm	SHA-256: 8b8db1668f7b13e877df86c2270f9e6146c4496b88f238921808fa1517bdc0e0
kdebase-3.3.1-5.12.i386.rpm	SHA-256: 8b8db1668f7b13e877df86c2270f9e6146c4496b88f238921808fa1517bdc0e0
kdebase-3.3.1-5.12.x86_64.rpm	SHA-256: 13fa40e01d347a6a62ca0dd8fb6c0c66153e440c0394189de40c0465e973cc99
kdebase-3.3.1-5.12.x86_64.rpm	SHA-256: 13fa40e01d347a6a62ca0dd8fb6c0c66153e440c0394189de40c0465e973cc99
kdebase-devel-3.3.1-5.12.x86_64.rpm	SHA-256: 9b965ec9cb03d6c55cd561b12e78959db8abcf50f352d57fc2c7536dd514d684
kdebase-devel-3.3.1-5.12.x86_64.rpm	SHA-256: 9b965ec9cb03d6c55cd561b12e78959db8abcf50f352d57fc2c7536dd514d684
ia64
kdebase-3.3.1-5.12.i386.rpm	SHA-256: 8b8db1668f7b13e877df86c2270f9e6146c4496b88f238921808fa1517bdc0e0
kdebase-3.3.1-5.12.i386.rpm	SHA-256: 8b8db1668f7b13e877df86c2270f9e6146c4496b88f238921808fa1517bdc0e0
kdebase-3.3.1-5.12.ia64.rpm	SHA-256: 6f78156bd913ddab627c8e1b1d54b1a13a28f683038d7edb70188de14a58b481
kdebase-3.3.1-5.12.ia64.rpm	SHA-256: 6f78156bd913ddab627c8e1b1d54b1a13a28f683038d7edb70188de14a58b481
kdebase-devel-3.3.1-5.12.ia64.rpm	SHA-256: f9be167d3b383f0a4d0f82c4ee6becdbc9299736d9812fa6f46e6dd2ce3ff3ab
kdebase-devel-3.3.1-5.12.ia64.rpm	SHA-256: f9be167d3b383f0a4d0f82c4ee6becdbc9299736d9812fa6f46e6dd2ce3ff3ab
i386
kdebase-3.3.1-5.12.i386.rpm	SHA-256: 8b8db1668f7b13e877df86c2270f9e6146c4496b88f238921808fa1517bdc0e0
kdebase-3.3.1-5.12.i386.rpm	SHA-256: 8b8db1668f7b13e877df86c2270f9e6146c4496b88f238921808fa1517bdc0e0
kdebase-devel-3.3.1-5.12.i386.rpm	SHA-256: 318d7a36055b7e9505beaa03acf6351157c0bd8965b8bcd51fef5e4a66d468cc
kdebase-devel-3.3.1-5.12.i386.rpm	SHA-256: 318d7a36055b7e9505beaa03acf6351157c0bd8965b8bcd51fef5e4a66d468cc

Red Hat Enterprise Linux Workstation 4

SRPM
kdebase-3.3.1-5.12.src.rpm	SHA-256: e8e295d0ed3c4e37ae58241e59f43ef3bd8743dc2c85543c1eeabfc5dcaa27e9
x86_64
kdebase-3.3.1-5.12.i386.rpm	SHA-256: 8b8db1668f7b13e877df86c2270f9e6146c4496b88f238921808fa1517bdc0e0
kdebase-3.3.1-5.12.x86_64.rpm	SHA-256: 13fa40e01d347a6a62ca0dd8fb6c0c66153e440c0394189de40c0465e973cc99
kdebase-devel-3.3.1-5.12.x86_64.rpm	SHA-256: 9b965ec9cb03d6c55cd561b12e78959db8abcf50f352d57fc2c7536dd514d684
ia64
kdebase-3.3.1-5.12.i386.rpm	SHA-256: 8b8db1668f7b13e877df86c2270f9e6146c4496b88f238921808fa1517bdc0e0
kdebase-3.3.1-5.12.ia64.rpm	SHA-256: 6f78156bd913ddab627c8e1b1d54b1a13a28f683038d7edb70188de14a58b481
kdebase-devel-3.3.1-5.12.ia64.rpm	SHA-256: f9be167d3b383f0a4d0f82c4ee6becdbc9299736d9812fa6f46e6dd2ce3ff3ab
i386
kdebase-3.3.1-5.12.i386.rpm	SHA-256: 8b8db1668f7b13e877df86c2270f9e6146c4496b88f238921808fa1517bdc0e0
kdebase-devel-3.3.1-5.12.i386.rpm	SHA-256: 318d7a36055b7e9505beaa03acf6351157c0bd8965b8bcd51fef5e4a66d468cc

Red Hat Enterprise Linux Desktop 4

SRPM
kdebase-3.3.1-5.12.src.rpm	SHA-256: e8e295d0ed3c4e37ae58241e59f43ef3bd8743dc2c85543c1eeabfc5dcaa27e9
x86_64
kdebase-3.3.1-5.12.i386.rpm	SHA-256: 8b8db1668f7b13e877df86c2270f9e6146c4496b88f238921808fa1517bdc0e0
kdebase-3.3.1-5.12.x86_64.rpm	SHA-256: 13fa40e01d347a6a62ca0dd8fb6c0c66153e440c0394189de40c0465e973cc99
kdebase-devel-3.3.1-5.12.x86_64.rpm	SHA-256: 9b965ec9cb03d6c55cd561b12e78959db8abcf50f352d57fc2c7536dd514d684
i386
kdebase-3.3.1-5.12.i386.rpm	SHA-256: 8b8db1668f7b13e877df86c2270f9e6146c4496b88f238921808fa1517bdc0e0
kdebase-devel-3.3.1-5.12.i386.rpm	SHA-256: 318d7a36055b7e9505beaa03acf6351157c0bd8965b8bcd51fef5e4a66d468cc

Red Hat Enterprise Linux for IBM z Systems 4

SRPM
kdebase-3.3.1-5.12.src.rpm	SHA-256: e8e295d0ed3c4e37ae58241e59f43ef3bd8743dc2c85543c1eeabfc5dcaa27e9
s390x
kdebase-3.3.1-5.12.s390.rpm	SHA-256: 0f5f65a353958626df34c81c93bd342e1277086a7c210ebee526e2616e2096d1
kdebase-3.3.1-5.12.s390x.rpm	SHA-256: a26738a644ff1e630a469d0089f3dd7127966ebaf08b3d14ec8c850c4ccabfc7
kdebase-devel-3.3.1-5.12.s390x.rpm	SHA-256: 851a5a3a95bb77f0edc9548235d248bb4f49a7c6a594fde76dcbb982813991dd
s390
kdebase-3.3.1-5.12.s390.rpm	SHA-256: 0f5f65a353958626df34c81c93bd342e1277086a7c210ebee526e2616e2096d1
kdebase-devel-3.3.1-5.12.s390.rpm	SHA-256: a897a02eed214f24a400974e79ddc4cb09b7c4d6fbff995c15e382ad1e6e029a

Red Hat Enterprise Linux for Power, big endian 4

SRPM
kdebase-3.3.1-5.12.src.rpm	SHA-256: e8e295d0ed3c4e37ae58241e59f43ef3bd8743dc2c85543c1eeabfc5dcaa27e9
ppc
kdebase-3.3.1-5.12.ppc.rpm	SHA-256: 60b9b803cd568162c9ccc8e31ca7a9fd067d7e98bba0292ec21c61e4a659de83
kdebase-3.3.1-5.12.ppc64.rpm	SHA-256: 7f4e4bc801bd0147903772313a9c0a603443a9144cfc0a0676847244920d9afd
kdebase-devel-3.3.1-5.12.ppc.rpm	SHA-256: 9d216c40b6efe9928970f398306ac756e7d431402239f1251c8f10bd6bf3eb69